xarmian e8e2a698b8 test(chat): sibling-DM coverage for inbox, unread and ensure (TASK-4060) (#2299) ...

* test(chat): sibling-DM coverage for inbox, unread and ensure (TASK-4060)

From the lead's post-merge rule-3a round on #2296. TestChat_AgentCannotReachSiblingAgentDM
now also covers the endpoints that could reveal bravo's DM without naming it:
alpha's inbox and unread summary carry no row for it and their totals exclude
it, with bravo's DM holding unread rows. Alpha ensuring agent_key "bravo" is
refused 400 with no DM bucket allocated and no conversation created, which is
where the DM bucket assertion can actually move. The delete case targets
bravo's own message so an author check cannot mask a leak, and the header
comment says which layer catches a single-layer leak and that the bucket
claim is allocation only.

Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd

* test(chat): make the ensure case's bucket and row checks able to fail (TASK-4060, r1)

Lead ruling on r1: the ensure case's DM-bucket and row-count assertions were
vacuous. The fixture's API ensures had already allocated the owner's ChatDM
bucket, and "bravo" already had a DM, so a charge or a create before the
refusal could not show. Both DMs are now seeded through the store, and alpha
is also refused naming "charlie", which has no DM yet. The seed comment now
says which unread row a leak would expose.

Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd

* test(chat): comments state what the sibling-DM cases prove (TASK-4060, r2)

Lead ruling on r2, comment-only: the delete case's rationale now says what
bravo's own message catches (alpha resolved as bravo would delete it), and
the header describes the single-layer leak behaviour instead of citing an
off-repo mutant id. The header also names the second ensure.

Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd

2026-10-24 06:10:59 -04:00

..

render

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

testdata

feat(server): chat HTTP API and access model (TASK-4039) (#2292)

2026-10-23 16:07:40 -04:00

access_epoch_test.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

access_epoch.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

access_kick.go

feat(server): revoking access re-checks live connections immediately (#1744)

2026-10-02 19:43:19 -04:00

activity_cursor_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

activity_cursor.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

agent_name.go

fix(chat): one 64-rune bound for agent keys (BUG-4055) (#2297)

2026-10-24 02:50:45 -04:00

app_api_attachments.go

fix(apps): an app upload is charged against the plan's storage cap (BUG-3653 part B) (#2119)

2026-10-13 15:44:44 -04:00

app_api_read.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

app_api_write.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

app_api.go

fix(apps): an app upload is charged against the plan's storage cap (BUG-3653 part B) (#2119)

2026-10-13 15:44:44 -04:00

app_attribution.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

app_delegated_consent.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

app_item_actions.go

feat(apps): admin Apps toggle, paused webhook status, app-name attribution, developer docs (TASK-3980) (#2258)

2026-10-20 10:29:59 -04:00

app_pending_sweep.go

feat(items): idempotency keys for patch writes (TASK-3585) (#2062)

2026-10-11 11:33:30 -04:00

app_tokens.go

fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398) (#1791)

2026-10-05 11:51:01 -04:00

app_upgrade_diff_test.go

feat(apps): app upgrade: staged preview with a classed diff, one-transaction confirm that re-derives it (TASK-3397, SPEC-6 U8b2) (#1777)

2026-10-04 16:16:29 -04:00

app_upgrade_diff.go

fix(server): the upgrade diff states what a widened delegated access grants (BUG-3427) (#1817)

2026-10-05 19:45:01 -04:00

app_webhook_delivery.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

app_webhooks.go

feat(apps): upgrade review and draft activation in Settings → Apps (TASK-3413, SPEC-6 U9b) (#1789)

2026-10-05 06:09:12 -04:00

apps_available.go

feat(apps): app attachment routes: item-scoped upload, metadata, and a streamed download re-admitted before its first byte (TASK-3401, SPEC-6 U6c) (#1776)

2026-10-04 15:14:27 -04:00

artifact_import_parity_test.go

feat(apps): app install provisioning, install codes and redeem (TASK-3397, SPEC-6 U8b) (#1772)

2026-10-04 11:59:42 -04:00

artifact_import.go

feat(apps): app install staging: apps/1 manifest, fetch policy, pending reservations, preview (TASK-3397, U8a) (#1770)

2026-10-04 07:19:07 -04:00

artifact_normalize.go

feat(apps): app install staging: apps/1 manifest, fetch policy, pending reservations, preview (TASK-3397, U8a) (#1770)

2026-10-04 07:19:07 -04:00

attachments_authz.go

fix(store): route cross-workspace copy's lock-held reads through the copy transaction (BUG-2409) (#1136)

2026-08-17 08:16:02 -04:00

authz_cross_workspace_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

authz_cross_workspace.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

body_reader_census_test.go

fix(mcp): MCP's long-lived streams keep alive and take a stream admission slot (BUG-3835) (#2197)

2026-10-15 13:18:36 -04:00

bootstrap_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

bootstrap.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

bug1791_archived_visibility_test.go

fix(items): surface archived items instead of masking them as missing (BUG-1791) (#733)

2026-06-15 14:44:58 -04:00

bug1926_me_admin_bearer_test.go

fix(server): the /me summary mirrors the admin bypass; every admin route proven open to an admin session, closed to an admin PAT (BUG-1926) (#1918)

2026-10-08 19:33:25 -04:00

bug2136_invite_consent_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

bug2367_close_state_test.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

bug2367_migrate_doors_test.go

fix(BUG-2367): moves and copies never carry into a computed field, and a carried unique-field collision is dropped and named instead of 500ing or storing a duplicate (#1514)

2026-09-24 13:12:32 -04:00

bug2639_guest_grant_terminal_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug2640_done_field_display_test.go

fix(project): standup and changelog rows show the value of the item's own done field, not a blank read from a literal status (BUG-2640) (#1477)

2026-09-23 19:37:58 -04:00

bug2683_bulk_move_dropped_test.go

test(BUG-2683): pin that a bulk move records an ordinary dropped field in its activity row, the case the bug was filed for (#1531)

2026-09-25 02:03:55 -04:00

bug2684_preflight_origin_test.go

test(BUG-2684): pin that the copy preflight labels a dropped-then-defaulted key from=default, the case the bug was filed for (#1533)

2026-09-25 01:36:38 -04:00

bug2685_grandfathered_reserved_key_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug2788_entry_id_stability_test.go

fix(timeline): structured entries get a persisted id instead of a positional one that renumbers when a sibling moves (BUG-2788) (#1540)

2026-09-25 07:10:26 -04:00

bug2812_scan_bench_test.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

bug2817_metrics_label_bound_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

bug2819_audit_source_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2819_filename_source_wiring_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2896_collection_traits_duplicate_keys_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

bug3028_relation_blank_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

bug3035_applier_seq_test.go

fix(cli): item edit refuses a stale body, guards its save with expected_seq, and keeps a recovery file on failure (BUG-3035) (#1418)

2026-09-21 21:03:05 -04:00

bug3037_expected_seq_test.go

feat(items): expected_seq — an OCC token that can tell two same-second writes apart (BUG-3037) (#1351)

2026-09-13 22:38:15 -04:00

bug3049_bulk_field_patch_test.go

fix(items): twelve item-field writers send a patch instead of replacing the blob (BUG-3049 / BUG-3055) (#1349)

2026-09-13 21:14:57 -04:00

bug3069_workspace_not_found_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

bug3079_default_drop_test.go

fix(items): an injected schema default takes the same type check a supplied value takes (BUG-3079) (#1362)

2026-09-14 09:03:24 -04:00

bug3080_client_write_test.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

bug3099_account_delete_owned_test.go

fix(store): account deletion reads the owned workspaces inside its transaction under the owner lock, so a workspace minted or unjoined in the window no longer survives its deleted owner (BUG-3099) (#1567)

2026-09-26 09:47:46 -04:00

bug3124_watermark_stamp_test.go

feat: a caught-up tab stamps the flush watermark, so viewing an item no longer leaves it pending (BUG-3124 unit B) (#1420)

2026-09-21 22:50:56 -04:00

bug3154_bulk_undeclared_key_test.go

fix(server): a bulk status or priority change refuses an item whose collection has no such field (BUG-3154) (#1450)

2026-09-23 03:09:25 -04:00

bug3163_reserved_write_doors_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug3167_query_or_contract_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug3202_field_number_precision_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3202_semantic_compare_test.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

bug3219_repeated_member_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3244_rebuild_seed_grant_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3244_schema_rebuild_set_aside_test.go

fix(collab): a schema rebuild sets aside the WHOLE op-log, so set-aside edits can be replayed (TASK-3574 (4)) (#2047)

2026-10-11 00:17:53 -04:00

bug3244_set_aside_guard_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3254_guest_workspace_get_test.go

fix(workspaces): GET /workspaces/{ws} marks a guest, so a guest who arrives by URL gets the guest sidebar, not member chrome (BUG-3254) (#1616)

2026-09-27 13:08:42 -04:00

bug3257_role_board_counts_test.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

bug3273_stream_soft_delete_test.go

fix(server): an open workspace event stream closes when its workspace is soft-deleted (BUG-3273) (#1638)

2026-09-28 11:04:51 -04:00

bug3307_workspace_slug_test.go

fix(store): reusing a recently deleted workspace's name no longer 500s, and a create that loses a slug race takes the next one (BUG-3307) (#1689)

2026-09-30 09:10:41 -04:00

bug3314_activity_ip_test.go

fix(store): activity reads a member can reach no longer return ip_address and user_agent (BUG-3314) (#1679)

2026-09-30 02:20:23 -04:00

bug3327_applier_version_test.go

fix(versions): an applier-path body write leaves a version row (BUG-3327) (#1709)

2026-10-01 23:56:37 -04:00

bug3331_search_scope_test.go

fix(search): scope workspace search to visible items (#1723)

2026-10-02 11:18:07 -04:00

bug3333_deleted_collection_grant_test.go

fix(store): reads exclude soft-deleted collections' items (BUG-3425) (#1820)

2026-10-05 21:18:56 -04:00

bug3334_fail_closed_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

bug3335_document_restore_scope_test.go

fix(documents): restore only a document of the URL's workspace (BUG-3335) (#1724)

2026-10-02 13:15:31 -04:00

bug3336_account_delete_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

bug3337_connection_authoritative_test.go

fix(mcp): a connection row decides workspace access, not the legacy token list (BUG-3337) (#1749)

2026-10-02 22:03:29 -04:00

bug3338_include_future_test.go

fix(oauth): include_future_workspaces is no longer a control; limit to current is an action (BUG-3338) (#1751)

2026-10-02 22:41:29 -04:00

bug3339_share_link_deleted_workspace_test.go

fix(share-links): a link stops resolving while its workspace is deleted (#1726)

2026-10-02 12:41:02 -04:00

bug3340_webhook_scope_test.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

bug3341_lease_permission_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

bug3342_role_board_scope_test.go

fix(server): role-board reorder refuses another workspace's item and counts its rows (BUG-3342) (#1750)

2026-10-02 22:16:36 -04:00

bug3343_sse_empty_collection_test.go

fix(sse): an item event without a collection is not workspace-level (BUG-3343) (#1729)

2026-10-02 13:52:04 -04:00

bug3346_body_ids_test.go

fix(api): body-supplied IDs must name something in the authorized workspace (BUG-3346) (#1728)

2026-10-02 13:34:22 -04:00

bug3347_access_epoch_effective_test.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

bug3348_unverified_email_access_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

bug3349_disable_test.go

fix(store): a role change or disable of a vanished user is 404, and the unguarded DisableUser is gone (BUG-3826) (#2196)

2026-10-15 08:23:56 -04:00

bug3350_session_kind_test.go

fix(auth): a CLI session is never a browser cookie, and sign-in refuses a cross-site form (BUG-3350) (#1747)

2026-10-02 20:48:37 -04:00

bug3353_legacy_token_test.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

bug3354_import_bundle_bomb_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3355_last_owner_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3356_set_plan_revision_test.go

fix(billing): a plan past its expiry entitles nothing, and Stripe plan writes are ordered (BUG-3356) (#1753)

2026-10-02 23:32:54 -04:00

bug3357_bundle_duplicate_attachment_test.go

fix(import): refuse duplicate source ids and attach by source id (#1740)

2026-10-02 17:51:55 -04:00

bug3357_bundle_ownership_test.go

fix(store): a workspace slug is slugified whichever door supplies it; migrate-to-pg keeps existing slugs (BUG-3769) (#2205)

2026-10-15 21:24:48 -04:00

bug3361_admin_pat_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

bug3366_index_doors_test.go

test(server): /items-index and /items-changes do not name an ungranted parent (BUG-3366, TASK-2215 review) (#1959)

2026-10-09 08:15:03 -04:00

bug3366_lineage_guest_test.go

fix(server): lineage and closure name only items the caller may see (#1743)

2026-10-02 18:49:07 -04:00

bug3372_attribution_test.go

fix(chat): one 64-rune bound for agent keys (BUG-4055) (#2297)

2026-10-24 02:50:45 -04:00

bug3379_imported_marker_test.go

feat(import): mark rows a workspace import wrote, author not verified (BUG-3379) (#1755)

2026-10-03 05:18:30 -04:00

bug3382_verify_claim_test.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

bug3395_retry_effects_test.go

fix(store): account deletion and workspace purge lock comments root first, and retry a residual deadlock (BUG-3395) (#1792)

2026-10-05 07:01:22 -04:00

bug3398_introspect_test.go

fix(oauth): introspection describes only the caller's own client's access tokens (BUG-3398) (#1791)

2026-10-05 11:51:01 -04:00

bug3400_reuse_ownership_test.go

fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400) (#1807)

2026-10-05 13:22:23 -04:00

bug3407_validated_schema_census_test.go

feat(collab): a patch to an item open in an editor applies as a narrowed replace (PLAN-3578 step 2) (#2056)

2026-10-11 07:45:12 -04:00

bug3416_app_me_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

bug3417_null_lists_test.go

fix(apps): every list in an apps JSON response is a list, never null (BUG-3417) (#1796)

2026-10-05 08:49:03 -04:00

bug3424_grant_path_ceiling_test.go

fix(server): the item-grant filter keeps an app request's read ceiling (BUG-3424) (#1825)

2026-10-06 01:33:24 -04:00

bug3425_deleted_collection_reads_test.go

fix(store): reads exclude soft-deleted collections' items (BUG-3425) (#1820)

2026-10-05 21:18:56 -04:00

bug3427_upgrade_delegated_copy_test.go

fix(server): the upgrade diff states what a widened delegated access grants (BUG-3427) (#1817)

2026-10-05 19:45:01 -04:00

bug3428_phase2_epoch_guard_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

bug3437_comment_on_update_test.go

fix(timeline): 'commented on update' only for a comment an update carried (BUG-3437) (#1832)

2026-10-06 12:57:14 -04:00

bug3438_register_invitation_claim_test.go

fix(server): register-with-code claims the invitation atomically; a gone invitation refuses and rolls the account back (BUG-3438) (#1834)

2026-10-06 15:48:30 -04:00

bug3446_blank_library_options_test.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

bug3447_collection_agent_activity_test.go

fix: the first-run launchpad follows an onboarding agent live (BUG-3447) (#1837)

2026-10-06 18:31:29 -04:00

bug3447_collection_create_event_test.go

fix: the first-run launchpad follows an onboarding agent live (BUG-3447) (#1837)

2026-10-06 18:31:29 -04:00

bug3453_ready_fallback_test.go

fix(server): an ordinary open backlog fills Up next and pad project ready (BUG-3453) (#1854)

2026-10-07 08:36:58 -04:00

bug3474_reval_fail_closed_test.go

fix(server): a collab revalidation tick that errors makes the conn read-only (BUG-3474) (#1866)

2026-10-07 19:45:14 -04:00

bug3479_remove_unusable_truth_test.go

fix(server): removeUnusableWorkspace reports a failed delete as kept (BUG-3479) (#1870)

2026-10-07 23:39:39 -04:00

bug3480_list_filter_keys_test.go

fix: item lists refuse a filter key that names no field (BUG-3480) (#1880)

2026-10-08 10:43:33 -04:00

bug3482_delete_totp_limit_test.go

fix(store): a user read no longer decrypts the TOTP secret; only the second-factor check does (BUG-4019) (#2275)

2026-10-21 15:57:29 -04:00

bug3530_share_order_test.go

fix(server): a shared collection lists items in the owner's arranged order (BUG-3530) (#1990)

2026-10-09 20:32:51 -04:00

bug3534_mcp_body_limit_test.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

bug3538_suggested_once_per_item_test.go

fix(dashboard): a task under two active plans no longer pins the skeleton (BUG-3538) (#2002)

2026-10-09 23:25:20 -04:00

bug3544_invite_setup_window_test.go

fix(server): a workspace invite in the setup window answers setup_required, not 500 (BUG-3544) (#2034)

2026-10-10 20:15:11 -04:00

bug3586_patch_timeout_test.go

fix(collab): a patch whose applier times out is not re-sent to another tab (BUG-3586) (#2059)

2026-10-11 08:33:52 -04:00

bug3626_account_export_test.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

bug3632_account_export_read_ctx_test.go

fix(server): the account export's store reads are cancelled at its deadline (BUG-3632) (#2223)

2026-10-17 19:32:06 -04:00

bug3634_restricted_owner_grant_test.go

fix(invitations): a pending invitation dies with its inviter's authority (BUG-3770) (#2214)

2026-10-16 21:14:10 -04:00

bug3635_share_archived_target_test.go

fix(share): a share link serves nothing once its item or collection is archived (BUG-3635) (#2167)

2026-10-14 11:49:45 -04:00

bug3637_sse_stalled_reader_test.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

bug3652_refused_upload_blob_test.go

fix(export): an export reads one snapshot, so a concurrent write cannot leave an item without its collection (BUG-3654) (#2122)

2026-10-14 00:25:14 -04:00

bug3653_app_storage_limit_test.go

fix(apps): an app upload is charged against the plan's storage cap (BUG-3653 part B) (#2119)

2026-10-13 15:44:44 -04:00

bug3653_storage_cap_doors_test.go

fix(storage): bundle import and cross-workspace copy are charged against the storage cap (BUG-3653, TASK-3625) (#2117)

2026-10-13 12:27:31 -04:00

bug3656_import_remap_test.go

fix(store): a workspace slug is slugified whichever door supplies it; migrate-to-pg keeps existing slugs (BUG-3769) (#2205)

2026-10-15 21:24:48 -04:00

bug3657_gzip_footer_test.go

fix(import): a bundle is not complete until its gzip footer verifies (BUG-3657) (#2158)

2026-10-14 09:52:25 -04:00

bug3658_relation_defaults_header_test.go

fix(import): relation defaults in imported schemas point at the imported items (BUG-3658) (#2159)

2026-10-14 08:53:26 -04:00

bug3659_account_export_deadline_test.go

fix(account): account export reads run inside the deadline, from one snapshot per workspace (BUG-3659) (#2160)

2026-10-14 10:09:13 -04:00

bug3665_move_payload_stale_test.go

fix(items): a move uses the item as it stands under the lock (BUG-3665) (#2165)

2026-10-14 11:08:56 -04:00

bug3669_share_csp_test.go

fix(share): a shared item body is sanitized with the markdown allowlist, and the SPA CSP restricts form-action (BUG-3669) (#2145)

2026-10-14 02:04:58 -04:00

bug3671_oauth_subject_test.go

fix(auth): an OAuth sign-in without a provider subject is refused, bound or not (BUG-3797) [deploy AFTER pad-cloud #81] (#2152)

2026-10-14 04:26:31 -04:00

bug3678_refresh_window_test.go

fix(oauth): a revoked grant mints nothing, and one refresh token rotates once (BUG-3678) (#2121)

2026-10-13 22:34:03 -04:00

bug3679_reset_link_after_password_change_test.go

fix(auth): a password change kills outstanding reset links (BUG-3679) (#2114)

2026-10-13 10:15:42 -04:00

bug3680_cross_site_signin_doors_test.go

fix(auth): reset-password, register and bootstrap refuse a cross-site form, as login does (BUG-3680) (#2146)

2026-10-14 03:30:20 -04:00

bug3687_activity_visible_page_test.go

fix(activity): the feed and dashboard count only rows the caller may see (BUG-3687) (#2169)

2026-10-14 13:00:57 -04:00

bug3703_list_filter_cap_test.go

fix(api): item lists are bounded at 1000 with has-more paging, and filter-key probing is bounded (BUG-3704, BUG-3703) (#2143)

2026-10-14 01:07:58 -04:00

bug3704_list_bounds_test.go

fix(api): item lists are bounded at 1000 with has-more paging, and filter-key probing is bounded (BUG-3704, BUG-3703) (#2143)

2026-10-14 01:07:58 -04:00

bug3746_prune_replace_fence_test.go

fix(collab): a REST content replacement fences tabs seeded from the old body, as a restore does (BUG-3746) (#2134)

2026-10-14 08:39:02 -04:00

bug3747_compaction_generation_test.go

fix(collab): a compaction snapshot covers only its own generation's cursors (BUG-3747) (#2142)

2026-10-13 23:30:26 -04:00

bug3768_restricted_owner_apps_test.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

bug3769_import_name_slug_test.go

fix(store): a workspace slug is slugified whichever door supplies it; migrate-to-pg keeps existing slugs (BUG-3769) (#2205)

2026-10-15 21:24:48 -04:00

bug3770_inviter_authority_test.go

fix(invitations): a pending invitation dies with its inviter's authority (BUG-3770) (#2214)

2026-10-16 21:14:10 -04:00

bug3773_watch_slug_cache_test.go

fix(server): a watch stream resolves each workspace slug once per tick, not per notification (BUG-3773) (#2210)

2026-10-16 09:58:53 -04:00

bug3789_bounded_lists_test.go

fix(api): children, starred and shared-collection lists are bounded at 1000 and paged; MCP starred caps at 300 (BUG-3789, BUG-3790, BUG-3792) (#2153)

2026-10-14 05:35:34 -04:00

bug3791_changes_cursor_test.go

fix(api): /changes is bounded at 1000 and continues by a cursor on the write order (BUG-3791) (#2151)

2026-10-14 03:34:15 -04:00

bug3796_changes_archived_grant_test.go

fix(changes): an archived granted item reaches its grantee through /changes (BUG-3796) (#2212)

2026-10-16 14:43:02 -04:00

bug3797_oauth_subject_required_test.go

fix(auth): an OAuth sign-in without a provider subject is refused, bound or not (BUG-3797) [deploy AFTER pad-cloud #81] (#2152)

2026-10-14 04:26:31 -04:00

bug3808_mcp_stalled_reader_test.go

fix(mcp): MCP's long-lived streams keep alive and take a stream admission slot (BUG-3835) (#2197)

2026-10-15 13:18:36 -04:00

bug3811_last_active_admin_test.go

fix(admin): the instance always keeps an active admin; demote, disable and self-delete share one locked guard (BUG-3811) (#2178)

2026-10-14 19:48:28 -04:00

bug3812_unique_race_test.go

fix(server,store): unique_scope values are checked again inside the write, under its lock (BUG-3812) (#2184)

2026-10-14 23:51:01 -04:00

bug3813_bulk_prelock_read_test.go

fix(server): bulk move and bulk tag re-check what they read before the lock (BUG-3813) (#2188)

2026-10-15 02:04:19 -04:00

bug3814_version_chain_snapshot_test.go

fix(store): version doors resolve the patch chain from the body read in the same snapshot (BUG-3814) (#2190)

2026-10-15 03:51:15 -04:00

bug3815_restore_unreconstructable_test.go

fix(store): version rows record their body's hash, and the walk refuses what it cannot verify (BUG-3820) (#2192)

2026-10-15 07:20:42 -04:00

bug3820_unverified_version_test.go

fix(store): version rows record their body's hash, and the walk refuses what it cannot verify (BUG-3820) (#2192)

2026-10-15 07:20:42 -04:00

bug3821_write_deadline_test.go

fix(server): /mcp middleware refusals get the response write deadline (BUG-3834) (#2199)

2026-10-15 09:28:16 -04:00

bug3825_import_unique_values_test.go

fix(store): import drops a unique value an earlier archive item holds, and says so (BUG-3825) (#2194)

2026-10-15 11:24:31 -04:00

bug3826_vanished_user_test.go

fix(store): a role change or disable of a vanished user is 404, and the unguarded DisableUser is gone (BUG-3826) (#2196)

2026-10-15 08:23:56 -04:00

bug3827_flush_error_shapes_test.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

bug3827_flush_error_test.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

bug3831_bulk_field_prelock_test.go

fix(server): bulk field update leaves coercion-only keys out of its patch and keeps any locked auto-date value (BUG-3831) (#2202)

2026-10-15 20:05:31 -04:00

bug3833_document_version_snapshot_test.go

fix(store): legacy document version doors resolve from the body read in the same snapshot (BUG-3833) (#2198)

2026-10-15 12:22:37 -04:00

bug3834_mcp_middleware_deadline_test.go

fix(server): /mcp middleware refusals get the response write deadline (BUG-3834) (#2199)

2026-10-15 09:28:16 -04:00

bug3835_mcp_keepalive_test.go

fix(mcp): MCP's long-lived streams keep alive and take a stream admission slot (BUG-3835) (#2197)

2026-10-15 13:18:36 -04:00

bug3837_mcp_credential_tick_test.go

fix(mcp): MCP's long-lived streams end with their credential (BUG-3837) (#2201)

2026-10-15 14:37:04 -04:00

bug3861_invite_role_test.go

fix(server): an invite with an unknown role answers 400, not 500 (BUG-3861) (#2255)

2026-10-20 14:30:33 -04:00

bug3864_forbidden_reason_test.go

fix(mcp): a refused call names its cause on both transports (BUG-3864) (#2218)

2026-10-17 19:11:58 -04:00

bug3870_member_dead_invitation_test.go

fix(invitations): a member accepting a dead invitation is already in, not told to get re-invited (BUG-3870) (#2217)

2026-10-17 11:32:56 -04:00

bug3976_settings_not_object_test.go

fix(store): collection settings must be a JSON object at every write door (BUG-3985) (#2260)

2026-10-20 18:11:13 -04:00

bug3978_rotation_ttl_test.go

fix(auth): a credential-change rotation keeps the session's own sliding window (BUG-3978) (#2254)

2026-10-20 07:32:16 -04:00

bug3982_pinned_token_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

bug3985_whitespace_settings_test.go

fix(store): collection settings must be a JSON object at every write door (BUG-3985) (#2260)

2026-10-20 18:11:13 -04:00

bug4019_totp_lazy_decrypt_test.go

fix(store): a user read no longer decrypts the TOTP secret; only the second-factor check does (BUG-4019) (#2275)

2026-10-21 15:57:29 -04:00

claim_codes_test.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

claim_codes.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

client_write_marks.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

cloud_admin_gate_test.go

fix(store): a role change or disable of a vanished user is 404, and the unguarded DisableUser is gone (BUG-3826) (#2196)

2026-10-15 08:23:56 -04:00

cloud_contract_test.go

feat(cloud): a Stripe event marker is a claim with a lease, so a handler that dies does not lose the event (BUG-3561, pad half) (#2043)

2026-10-11 00:02:50 -04:00

collection_resolve_test.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

collection_resolve.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

compress_routes_test.go

feat(server): gzip what the client accepts, except streams, upgrades, ranges and secrets (TASK-2225) (#1934)

2026-10-09 03:16:26 -04:00

content_disposition_test.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_disposition.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_state_population_test.go

fix(web): a body the server marks as behind its live document says so wherever it is rendered — share pages, the read-only pane, the diff, and a dot on marked rows in lists, backlinks and the palette (BUG-3050 U3) (#1577)

2026-09-26 13:37:34 -04:00

content_write_guard.go

feat(items): agent body writes are version-checked by default, phase 1: count, warn, replace (PLAN-3555) (#2054)

2026-10-11 05:29:53 -04:00

context.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

copy_preflight_drop_reason_parity_test.go

IDEA-2893 + IDEA-2894: record the accepted carry disclosure, and make the drop-reason mapper testable (#1254)

2026-09-05 19:01:57 -04:00

dashboard_attention_decisions_test.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

decision_settings_test.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

decision_settings.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

decision_tick.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

decode_json_nul_test.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

decode_json_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

document_lock_contention_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

effort_backfill_lifecycle_test.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

events_publish_test.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_publish.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_surface_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

events_surface.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

flush_error_writer.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

funnel_metrics.go

feat(metrics): signup and first-write funnel metrics; TouchUserWrite reports the first write (TASK-3926) (#2227)

2026-10-18 23:25:22 -04:00

handlers_2fa_recovery_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

handlers_2fa_totp_step_test.go

fix(security): make TOTP login codes single-use (BUG-2054) (#914)

2026-07-10 23:56:59 -04:00

handlers_2fa.go

fix(store): a user read no longer decrypts the TOTP secret; only the second-factor check does (BUG-4019) (#2275)

2026-10-21 15:57:29 -04:00

handlers_account_export_contract_test.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

handlers_account_export_gate_test.go

fix(server): an account export that times out or fails says so, instead of arriving short (BUG-3626) (#2109)

2026-10-12 15:12:22 -04:00

handlers_account_test.go

fix(admin): the instance always keeps an active admin; demote, disable and self-delete share one locked guard (BUG-3811) (#2178)

2026-10-14 19:48:28 -04:00

handlers_account.go

fix(auth): a browser-approved CLI token gets its own lifetime (TASK-3975) (#2252)

2026-10-20 13:30:31 -04:00

handlers_activity_debounce_actor_test.go

fix(store): activity debounce must not merge across writers (BUG-2763) (#1201)

2026-08-25 14:28:29 -04:00

handlers_activity.go

feat(web): catch-up card, Mark caught up, and See everything into Activity (TASK-3615, PR B) (#2226)

2026-10-18 14:42:40 -04:00

handlers_admin_bearer_gate_test.go

fix(security): gate collab WebSocket writes on editor role (TASK-265) (#938)

2026-07-15 01:30:12 -04:00

handlers_admin_billing_test.go

fix(billing): admin stats count upgrades by when the account became Pro (BUG-3591) (#2069)

2026-10-11 16:25:01 -04:00

handlers_admin_billing.go

fix(billing): admin stats count upgrades by when the account became Pro (BUG-3591) (#2069)

2026-10-11 16:25:01 -04:00

handlers_admin_invitations.go

fix(store): an admin resend revokes and re-creates in one transaction that re-reads the workspace (BUG-3817) (#2193)

2026-10-15 16:19:58 -04:00

handlers_admin_mcp_test.go

feat(mcp): MCP addressing from config; mcp_enabled setting with an env lock (TASK-3302, PLAN-2310 U1) (#1662)

2026-09-29 12:46:03 -04:00

handlers_admin_mcp.go

fix(mcp): cloud refuses to start without an https origin for MCP OAuth; a blocked self-hosted MCP says so (TASK-1069) (#1920)

2026-10-08 21:23:12 -04:00

handlers_admin_settings_test.go

fix(admin): stop leaking 2FA secret via GET /admin/settings (BUG-1909) (#779)

2026-07-01 17:44:43 -04:00

handlers_admin_users_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_admin_users.go

fix(store): a role change or disable of a vanished user is 404, and the unguarded DisableUser is gone (BUG-3826) (#2196)

2026-10-15 08:23:56 -04:00

handlers_admin.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

handlers_agent_roles.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

handlers_apps_delivery_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

handlers_apps_install_test.go

feat(apps): admin Apps toggle, paused webhook status, app-name attribution, developer docs (TASK-3980) (#2258)

2026-10-20 10:29:59 -04:00

handlers_apps_install.go

feat(apps): admin Apps toggle, paused webhook status, app-name attribution, developer docs (TASK-3980) (#2258)

2026-10-20 10:29:59 -04:00

handlers_apps_lifecycle.go

fix(apps): a collection-restricted owner cannot grant an app whole-workspace access (BUG-3768) (#2123)

2026-10-13 14:41:33 -04:00

handlers_apps_provision_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

handlers_apps_provision.go

fix(mcp): a refused call names its cause on both transports (BUG-3864) (#2218)

2026-10-17 19:11:58 -04:00

handlers_apps_u10c_test.go

feat(apps): per-endpoint webhook delivery state, a per-install rate cap, and a 24 h drop (TASK-3408, SPEC-6 U10c) (#1783)

2026-10-05 00:02:49 -04:00

handlers_apps_upgrade_test.go

feat(apps): app upgrade: staged preview with a classed diff, one-transaction confirm that re-derives it (TASK-3397, SPEC-6 U8b2) (#1777)

2026-10-04 16:16:29 -04:00

handlers_apps_upgrade.go

fix(mcp): a refused call names its cause on both transports (BUG-3864) (#2218)

2026-10-17 19:11:58 -04:00

handlers_apps_webhooks_test.go

feat(apps): admin Apps toggle, paused webhook status, app-name attribution, developer docs (TASK-3980) (#2258)

2026-10-20 10:29:59 -04:00

handlers_artifact_export_device_test.go

fix(BUG-3185): an item export's file name whose stem is a Windows device gets a "_" prefix, on the server and in the CLI (#1495)

2026-09-24 03:44:11 -04:00

handlers_artifact_export.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

handlers_artifact_import_relation_carry_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

handlers_artifact_import_warnings_test.go

WIP feat(server,store): referent validation for relation values — 6 of 8 doors (TASK-2878) (#1246)

2026-09-05 10:07:44 -04:00

handlers_artifact_import.go

feat(apps): app install provisioning, install codes and redeem (TASK-3397, SPEC-6 U8b) (#1772)

2026-10-04 11:59:42 -04:00

handlers_artifact_test.go

fix(cli): refuse a blank --stdin body on item create/update; add --clear-content (BUG-3100) (#1415)

2026-09-21 18:52:28 -04:00

handlers_attachments_attach_test.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_attach.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_bug2818_test.go

fix(attachments): the blocklist judges the same filename the download header serves (BUG-2818) (#1445)

2026-09-22 20:54:46 -04:00

handlers_attachments_bug2822_test.go

fix(attachments): a stored name Windows would open as a device gets a "_" prefix (BUG-2822) (#1493)

2026-09-24 02:37:59 -04:00

handlers_attachments_bug3153_test.go

fix(attachments): drop Bidi_Control characters from attachment names and rewrite legacy rows (BUG-3153) (#1452)

2026-09-23 04:35:58 -04:00

handlers_attachments_download_authz_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_download_mime_test.go

fix(server): force-download unknown and disallowed stored MIME (BUG-2413)

2026-08-08 20:37:39 +00:00

handlers_attachments_download_test.go

fix(ci): gofmt + bump race-detector timeout to 30m (#299)

2026-04-29 15:41:12 -04:00

handlers_attachments_isobmff_test.go

fix(attachments): HEIC, HEIF and AVIF are recognised from their bytes, not refused (BUG-2961) (#1291)

2026-09-08 13:30:42 -04:00

handlers_attachments_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_attachments_thumbnails_parent_test.go

fix(attachments): skip derivation for an archived parent (TASK-2404)

2026-08-01 23:27:34 +00:00

handlers_attachments_thumbnails_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_attachments_thumbnails.go

feat(appstore): app attachment upload, read rule and caps behind FencedTx (TASK-3396, U7a) (#1768)

2026-10-03 21:31:44 -04:00

handlers_attachments_transform_authz_test.go

fix(attachments): gate transform on item visibility (TASK-2402)

2026-08-01 23:05:26 +00:00

handlers_attachments_transform_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_transform.go

fix(attachments): a refused upload, transform or import reclaims the blob it wrote (BUG-3652) (#2118)

2026-10-13 13:24:49 -04:00

handlers_attachments_upload_live_item_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_variant_headers_test.go

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

handlers_attachments.go

feat(metrics): signup and first-write funnel metrics; TouchUserWrite reports the first write (TASK-3926) (#2227)

2026-10-18 23:25:22 -04:00

handlers_audit.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

handlers_auth_admin_register_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_auth_bootstrap_bypass_test.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

handlers_auth_bootstrap_token_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

handlers_auth_local_reset_test.go

feat(auth): localhost password recovery for locked-out self-host admins (#760)

2026-06-22 20:58:50 -04:00

handlers_auth_loopback_test.go

fix(server): read raw TCP peer for loopback check (TASK-662) (#175)

2026-04-21 19:33:47 -04:00

handlers_auth_ratelimit_test.go

feat(auth): per-email login rate limiter (TASK-651) (#178)

2026-04-21 20:52:03 -04:00

handlers_auth_replaced_session_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_auth_session_rotation_test.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

handlers_auth_test.go

feat(billing): billing availability and prices come from the sidecar; PAD_BILLING=auto|off (TASK-3577) (#2048)

2026-10-11 01:29:49 -04:00

handlers_auth.go

feat(server): push device registration and notification settings API (TASK-3938) (#2269)

2026-10-21 06:49:54 -04:00

handlers_backlinks_admin_bearer_test.go

fix(backlinks): scope cross-workspace admin enumeration to membership for bearer auth (BUG-1617) (#633)

2026-05-27 10:37:30 -04:00

handlers_backlinks.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_bootstrap_test.go

fix(server): guard degraded/degraded_sections in bootstrap dashboard (BUG-2072) (#869)

2026-07-08 13:09:26 -04:00

handlers_bootstrap.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

handlers_bug3322_totp_doors_test.go

fix(auth): an OAuth sign-in without a provider subject is refused, bound or not (BUG-3797) [deploy AFTER pad-cloud #81] (#2152)

2026-10-14 04:26:31 -04:00

handlers_builtin.go

feat(web): review and accept built-in updates from the Library page and the item pane (TASK-3462 U3b) (#1873)

2026-10-08 02:53:41 -04:00

handlers_capabilities.go

feat(items): idempotency keys for patch writes (TASK-3585) (#2062)

2026-10-11 11:33:30 -04:00

handlers_catch_up.go

feat(server): per-user catch-up digest and read cursor (TASK-3615, PR A) (#2219)

2026-10-18 12:12:51 -04:00

handlers_changelog_abandoned_test.go

fix(project): a collection's own abandoned_options decide what the changelog, standup and reports count as shipped (BUG-2347) (#1464)

2026-09-23 12:52:46 -04:00

handlers_changes.go

fix(changes): an archived granted item reaches its grantee through /changes (BUG-3796) (#2212)

2026-10-16 14:43:02 -04:00

handlers_chat_dto.go

feat(server): chat HTTP API and access model (TASK-4039) (#2292)

2026-10-23 16:07:40 -04:00

handlers_chat_enrich_test.go

feat(server): chat HTTP API and access model (TASK-4039) (#2292)

2026-10-23 16:07:40 -04:00

handlers_chat_enrich.go

feat(server): chat HTTP API and access model (TASK-4039) (#2292)

2026-10-23 16:07:40 -04:00

handlers_chat_guard_test.go

feat(server): chat HTTP API and access model (TASK-4039) (#2292)

2026-10-23 16:07:40 -04:00

handlers_chat_test.go

fix(chat): one 64-rune bound for agent keys (BUG-4055) (#2297)

2026-10-24 02:50:45 -04:00

handlers_chat.go

fix(chat): one 64-rune bound for agent keys (BUG-4055) (#2297)

2026-10-24 02:50:45 -04:00

handlers_chatgpt_mcp.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

handlers_claim_code_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_claim_code.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_cli_auth_test.go

fix(server): derive CLI auth URL scheme from r.TLS, gate X-Forwarded-Proto on trusted proxies (TASK-665) (#190)

2026-04-22 09:27:45 -04:00

handlers_cli_auth.go

fix(auth): a browser-approved CLI token gets its own lifetime (TASK-3975) (#2252)

2026-10-20 13:30:31 -04:00

handlers_cloud_autocreate_husk_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_autocreate_workspace_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_member_ack_test.go

fix(cloud): reconcile before destroying a workspace whose owner-add lost its ack (BUG-3026) (#1341)

2026-09-11 19:34:44 -04:00

handlers_cloud.go

fix(store): an unlink re-checks that a sign-in method remains under the account lock (BUG-3816) (#2191)

2026-10-15 17:23:24 -04:00

handlers_collab_applier_refusal_test.go

fix(server): a successful applier-path PATCH stops answering with the previous content (BUG-2995) (#1320)

2026-09-10 12:37:49 -04:00

handlers_collab_bug1308_test.go

test(collab): rate-bucket tests freeze their own bucket instead of racing the refill (BUG-3410) (#1788)

2026-10-05 05:08:38 -04:00

handlers_collab_prune_atomicity_test.go

fix(server): the op-log prune rides inside the write it justifies (BUG-2840 half B) (#1295)

2026-09-08 16:46:28 -04:00

handlers_collab_set_aside.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_collab_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_collab_watermark.go

feat(collab): count and log watermark stamps that cover content-bearing rows (TASK-3541 step 0) (#2023)

2026-10-10 11:54:42 -04:00

handlers_collab.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_collection_crud_visibility_test.go

fix(server): gate collection update/delete on visibility (BUG-1921) (#795)

2026-07-03 18:12:35 -04:00

handlers_collection_traits_rename_test.go

feat(store,server,web): collection kernel traits — de-hardcode conventions/playbooks slugs (TASK-2657, BUG-2702) (#1171)

2026-08-20 13:26:05 -04:00

handlers_collection_traits_test.go

feat(store,server): make collection trait uniqueness a database invariant — de-dup pass + partial unique indexes (TASK-2710) (#1257)

2026-09-05 20:43:43 -04:00

handlers_collections_concurrency_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_collections_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_collections_reserved_keys_test.go

fix(server): reserve parent/plan schema field keys (TASK-1912) (#786)

2026-07-03 03:27:04 -04:00

handlers_collections.go

fix(store): collection settings must be a JSON object at every write door (BUG-3985) (#2260)

2026-10-20 18:11:13 -04:00

handlers_comments_atomic_test.go

fix(comments): the "commented" activity and the comment commit in one transaction (BUG-2716) (#1388)

2026-09-15 16:36:26 -04:00

handlers_comments_bearer_gate_test.go

fix(server): bearer-gate canEditComment's admin bypass (BUG-1919) (#796)

2026-07-03 18:24:36 -04:00

handlers_comments_edit_test.go

feat(comments): comment editing backend — user_id, UpdateComment, PATCH, SSE (TASK-1663) (#665)

2026-05-30 12:38:57 -04:00

handlers_comments_item_scoped_test.go

fix(comments): a deleted comment with replies leaves a tombstone (BUG-3252) (#1675)

2026-09-30 00:41:20 -04:00

handlers_comments.go

feat(store): @mentions enqueue a push notification (TASK-3946) (#2272)

2026-10-21 10:12:15 -04:00

handlers_connected_apps_mutations_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

handlers_connected_apps_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_connected_apps.go

feat(oauth): delegated sign-in for installed apps through the issuance barrier, shipped closed (TASK-3399, SPEC-6 U5b-1) (#1779)

2026-10-04 19:22:21 -04:00

handlers_content_state_doors_test.go

fix(items): eleven hand-built doors carry the stale-body marker (BUG-3033) (#1344)

2026-09-13 18:34:16 -04:00

handlers_convention_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_dashboard_test.go

fix(server): an ordinary open backlog fills Up next and pad project ready (BUG-3453) (#1854)

2026-10-07 08:36:58 -04:00

handlers_dashboard.go

feat(decision): debounce decision re-asks with decision_jobs.not_before (TASK-3916) (#2230)

2026-10-19 04:08:03 -04:00

handlers_decisions_test.go

feat(decision): debounce decision re-asks with decision_jobs.not_before (TASK-3916) (#2230)

2026-10-19 04:08:03 -04:00

handlers_decisions.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_documents_test.go

fix(fields,activity): debounce typed-input field saves + collapse same-field activity runs (BUG-1466) (#549)

2026-05-14 22:10:12 -04:00

handlers_documents_title_test.go

fix(documents): bound the rename cascade at the title and at the projected total (BUG-2798, BUG-2796) (#1218)

2026-08-27 22:45:27 -04:00

handlers_documents.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

handlers_events_access_epoch_stream_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_access_epoch_test.go

fix: the access epoch tracks the live collection set; deleted collections leave the local index; the open-children guard ignores them (BUG-3428 phase 2) (#1826)

2026-10-06 07:59:20 -04:00

handlers_events_cancel_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_failed_test.go

fix(events): a closed MemoryBus refuses a late subscribe instead of handing out a channel nothing will close (BUG-2737) (#1483)

2026-09-23 21:52:18 -04:00

handlers_events_filter_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_events_membership_test.go

fix(server): an event stream whose client stops reading ends instead of pinning its handler (BUG-3637) (#2172)

2026-10-14 16:47:40 -04:00

handlers_events_resume_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_revalidation_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_export_bundle_test.go

feat(attachments): bundle attachments + manifest in workspace export (TASK-884) (#305)

2026-04-29 18:30:43 -04:00

handlers_export_bundle.go

fix(export): an export reads one snapshot, so a concurrent write cannot leave an item without its collection (BUG-3654) (#2122)

2026-10-14 00:25:14 -04:00

handlers_export_gate_test.go

fix(server): deny workspace export to restricted owners (BUG-1922) (#813)

2026-07-04 13:54:08 -04:00

handlers_grant_visibility_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_grants.go

fix(mcp): a refused call names its cause on both transports (BUG-3864) (#2218)

2026-10-17 19:11:58 -04:00

handlers_graph_test.go

fix(server): bearer-gate visibleCollectionIDs to close BUG-1917 (#792)

2026-07-03 14:40:54 -04:00

handlers_graph.go

feat(server): focused neighborhood mode on workspace graph endpoint (TASK-1781) (#718)

2026-06-08 18:13:10 -04:00

handlers_import_bundle_bug3184_test.go

fix(server): an interrupted import rolls back, and its outcome can be asked for (BUG-3475) (#1867)

2026-10-07 21:03:24 -04:00

handlers_import_bundle_bug3191_test.go

fix(import): a panic after a bundle import creates its workspace takes the keep door, then re-panics (BUG-3191) (#1501)

2026-09-24 05:49:44 -04:00

handlers_import_bundle_bug3475_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_import_bundle_comment_refs_test.go

fix(store): cover documents and comment bodies in the attachment reference walks (BUG-2614, BUG-2615) (#1145)

2026-08-17 14:26:09 -04:00

handlers_import_bundle_husk_test.go

fix(store): a workspace slug is slugified whichever door supplies it; migrate-to-pg keeps existing slugs (BUG-3769) (#2205)

2026-10-15 21:24:48 -04:00

handlers_import_bundle_partial_test.go

fix(store): a workspace slug is slugified whichever door supplies it; migrate-to-pg keeps existing slugs (BUG-3769) (#2205)

2026-10-15 21:24:48 -04:00

handlers_import_bundle_summary_test.go

feat(import): a bundle import reports what it carried next to what arrived, and a guide walks a self-hosted workspace to Pad Cloud (TASK-3612) (#2100)

2026-10-12 07:01:44 -04:00

handlers_import_bundle_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_import_bundle.go

fix(store): import drops a unique value an earlier archive item holds, and says so (BUG-3825) (#2194)

2026-10-15 11:24:31 -04:00

handlers_import_partial_marker_test.go

fix(store): a workspace slug is slugified whichever door supplies it; migrate-to-pg keeps existing slugs (BUG-3769) (#2205)

2026-10-15 21:24:48 -04:00

handlers_import_stale_bodies_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_import_test.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_import.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_invitation_accept_limit_test.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

handlers_invitation_deleted_workspace_test.go

fix(store,server): an invitation to a soft-deleted workspace reads as unknown (BUG-3104) (#1413)

2026-09-21 17:58:27 -04:00

handlers_invitation_email_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_invitation_preview_test.go

fix(server): invitation-preview endpoint + read-only email prefill on /join (BUG-1934) (#803)

2026-07-03 23:47:06 -04:00

handlers_item_context.go

feat(server): the item brief carries only the decisions Pad would surface, and counts the rest (TASK-3618) (#2107)

2026-10-12 11:53:29 -04:00

handlers_item_lease_test.go

fix(leases): bind item leases to the claiming account (#1731)

2026-10-02 14:20:58 -04:00

handlers_item_lease.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

handlers_item_links_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_item_links.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_item_versions_bounds_test.go

fix: bound item history and stop resolving bodies nobody reads (BUG-2608) (#1147)

2026-08-17 19:02:53 -04:00

handlers_item_versions_bug3031_pg_test.go

fix(versions): a restore over unsaved collaborative edits is refused unless the caller consents to discarding them (BUG-3031) (#1573)

2026-09-26 12:57:38 -04:00

handlers_item_versions_bug3031_test.go

fix: an overwrite, including a confirmed version restore, that deleted another tab's unsaved edits says how many (BUG-3230 U2) (#1595)

2026-09-26 23:25:18 -04:00

handlers_item_versions_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_item_versions.go

fix(store): version doors resolve the patch chain from the body read in the same snapshot (BUG-3814) (#2190)

2026-10-15 03:51:15 -04:00

handlers_items_access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

handlers_items_ack_loss_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_append_test.go

fix(items): note and decide append server-side under the write lock, so they no longer revert a concurrent field write (BUG-3056) (#1458)

2026-09-23 07:46:45 -04:00

handlers_items_attribution_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_items_bug3133_pending_guard_test.go

fix: refuse a token-guarded content write over unflushed tab edits (BUG-3133) (#1423)

2026-09-22 00:42:02 -04:00

handlers_items_bug3230_refuse_pending_test.go

fix(web): the item pane's raw-markdown saves are refused, not applied, over another tab's unstored edits; an unload save keeps its text for recovery (BUG-3230 U0) (#1590)

2026-09-26 21:28:37 -04:00

handlers_items_bulk_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_bulk.go

fix(mcp): a refused call names its cause on both transports (BUG-3864) (#2218)

2026-10-17 19:11:58 -04:00

handlers_items_collab_versions_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_items_content_echo_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_content_route_test.go

fix(collab): an open tab refuses a content write over typing the server has not stored (BUG-3542) (#2016)

2026-10-10 09:08:04 -04:00

handlers_items_content_route.go

fix(server,store): unique_scope values are checked again inside the write, under its lock (BUG-3812) (#2184)

2026-10-14 23:51:01 -04:00

handlers_items_content_state_test.go

feat(items): content_state marks a body the server knows is stale (BUG-3000) (#1343)

2026-09-13 10:51:03 -04:00

handlers_items_copy_attachment_authz_test.go

fix(copy): authorize attachment references in cross-workspace copy (TASK-2408)

2026-08-02 04:54:31 +00:00

handlers_items_copy_content_state_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_items_copy_parity_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_items_copy_preflight_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy_preflight.go

fix(store): a link row counts only when both endpoints live in its workspace (BUG-3776) (#2208)

2026-10-16 06:13:11 -04:00

handlers_items_copy_relation_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

handlers_items_copy_resolve.go

fix(items): a keyed replay of an archived-source move re-checks the destination (TASK-3585) (#2087)

2026-10-11 20:34:11 -04:00

handlers_items_copy_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy.go

fix(storage): bundle import and cross-workspace copy are charged against the storage cap (BUG-3653, TASK-3625) (#2117)

2026-10-13 12:27:31 -04:00

handlers_items_field_coercion_test.go

test(server): pin the last three coercion call sites (BUG-2850)

2026-09-03 12:49:33 +00:00

handlers_items_fieldpatch_test.go

feat(items): field-level PATCH + conflict envelope + read-only version history (TASK-2022) (#876)

2026-07-08 16:47:34 -04:00

handlers_items_github_pr_test.go

fix(items): github_pr is written only through a typed, validated update member; the field-setter door refuses it (BUG-2696, ToolSurfaceVersion 0.47) (#1469)

2026-09-23 14:35:41 -04:00

handlers_items_jsonb_inner_shape_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_items_move_overrides_test.go

fix(server): a move refuses a field override the destination does not declare, as the copy does (BUG-2379) (#1448)

2026-09-23 00:02:43 -04:00

handlers_items_moved_out_test.go

fix(sync): moved-out tombstones for cross-visibility collection moves (BUG-1675) (#670)

2026-05-30 19:57:45 -04:00

handlers_items_open_children_guard_test.go

fix(deps): bump go-jose/v3 to v3.0.5 to clear GO-2026-4945 (BUG-1619) (#634)

2026-05-27 13:21:57 -04:00

handlers_items_open_children_guard.go

fix(collab): a markdown applier request that timed out is not re-sent to another tab (BUG-3748) (#2133)

2026-10-13 15:28:37 -04:00

handlers_items_parent_ambiguity_test.go

fix(server): refuse a PATCH carrying both a fields hierarchy key and top-level parent_id (BUG-2594) (#1133)

2026-08-17 03:42:08 -04:00

handlers_items_patch.go

fix(collab): a REST content replacement fences tabs seeded from the old body, as a restore does (BUG-3746) (#2134)

2026-10-14 08:39:02 -04:00

handlers_items_preimage_test.go

fix(server): diff the activity change list against the store's pre-image (BUG-2776) (#1206)

2026-08-25 20:16:18 -04:00

handlers_items_refuse_undeclared_test.go

fix(mcp): bulk-update refuses an undeclared status/priority per item on stdio and remote too (BUG-3156, ToolSurfaceVersion 0.46) (#1463)

2026-09-23 10:48:28 -04:00

handlers_items_rename_cascade_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_items_reserved_fieldpatch_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_items_reserved_write.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

handlers_items_sort_order.go

feat: bulk sort_order: one all-or-nothing request per lane reorder, one activity row per item collapsed per batch (TASK-3517) (#1933)

2026-10-09 02:04:52 -04:00

handlers_items_test.go

fix(server): attribution comes from the request, never the body (BUG-3372) (#1754)

2026-10-03 03:51:24 -04:00

handlers_items_title_test.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

handlers_items.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

handlers_library_activate.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

handlers_library_entry.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_library_test.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_mcp_audit_test.go

feat(admin): the MCP audit page names users and connections instead of truncated UUIDs (TASK-2255 C110) (#2032)

2026-10-10 18:32:29 -04:00

handlers_mcp_audit.go

feat(admin): the MCP audit page names users and connections instead of truncated UUIDs (TASK-2255 C110) (#2032)

2026-10-10 18:32:29 -04:00

handlers_mcp_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_mcp_tool_surface_test.go

feat(server): expose MCP tool-surface over authed REST endpoint (#764)

2026-06-24 22:45:32 -04:00

handlers_mcp.go

fix(mcp): MCP's long-lived streams end with their credential (BUG-3837) (#2201)

2026-10-15 14:37:04 -04:00

handlers_me_needs_test.go

feat(needs): sort=importance|simplicity with a score-keyed cursor (TASK-3959, part 2) (#2274)

2026-10-21 12:38:23 -04:00

handlers_me_needs.go

feat(needs): sort=importance|simplicity with a score-keyed cursor (TASK-3959, part 2) (#2274)

2026-10-21 12:38:23 -04:00

handlers_me_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_me.go

fix(server): the /me summary mirrors the admin bypass; every admin route proven open to an admin session, closed to an admin PAT (BUG-1926) (#1918)

2026-10-08 19:33:25 -04:00

handlers_member_collection_access_escalation_test.go

fix(server): deny restricted owners from escalating collection access (BUG-1925) (#815)

2026-07-04 14:39:33 -04:00

handlers_members.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_my_invitations.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

handlers_needs_snooze_test.go

feat(needs): per-user dismiss/defer storage and the needs/snooze routes (TASK-3918) (#2231)

2026-10-19 07:02:00 -04:00

handlers_needs_snooze.go

feat(needs): per-user dismiss/defer storage and the needs/snooze routes (TASK-3918) (#2231)

2026-10-19 07:02:00 -04:00

handlers_notifications.go

feat(push): GET /me/notifications/{id} enrichment and the real-enqueue mention leg (TASK-3939 part B2b) (#2284)

2026-10-22 12:04:46 -04:00

handlers_oauth_claim_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_oauth_claim.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_clients.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_provider_test.go

fix(auth): an OAuth sign-in without a provider subject is refused, bound or not (BUG-3797) [deploy AFTER pad-cloud #81] (#2152)

2026-10-14 04:26:31 -04:00

handlers_oauth_test.go

fix(oauth): another client's replay of a spent refresh token or code revokes nothing (BUG-3400) (#1807)

2026-10-05 13:22:23 -04:00

handlers_oauth.go

fix(oauth): the consent screen names Pad, the instance, the user's workspaces and the return host (TASK-1071) (#2017)

2026-10-10 09:15:51 -04:00

handlers_openai_challenge.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

handlers_plan_limit_race_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

handlers_plan_source_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_playbook_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_playbook_match_ratelimit_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

handlers_playbook_match_test.go

feat(playbook): match free text to an active playbook via the decision provider (TASK-3120) (#1429)

2026-09-22 11:28:57 -04:00

handlers_playbooks_test.go

fix(playbooks): enforce draft gate server-side + expose status (BUG-2020) (#874)

2026-07-08 15:28:21 -04:00

handlers_playbooks.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

handlers_project_intel_test.go

fix(server): lineage and closure name only items the caller may see (#1743)

2026-10-02 18:49:07 -04:00

handlers_project_intel.go

feat(server): reference items stop counting as open work (PLAN-3535 PR 2) (#2000)

2026-10-09 22:31:16 -04:00

handlers_push_cross_instance_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_delivery_symmetry_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_devices_test.go

feat(server): push device registration and notification settings API (TASK-3938) (#2269)

2026-10-21 06:49:54 -04:00

handlers_push_devices.go

feat(push): start the push dispatcher at server startup when a gateway is set (TASK-3939 B2c) (#2286)

2026-10-22 16:17:56 -04:00

handlers_push_presence_unreadable_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_publish_result_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push_store_error_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

handlers_push_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_push_visibility_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

handlers_rbac_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_ref_resolver_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

handlers_ref_resolver.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_relation_backlinks.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

handlers_reminders_test.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

handlers_reminders.go

feat(mcp): pad_item reminders lists an item's reminders and unremind disarms one (TASK-3611) (#2097)

2026-10-12 03:18:50 -04:00

handlers_reports_test.go

feat(report): windowed project report endpoint + DateBucket dialect (TASK-1630) (#638)

2026-05-29 08:24:05 -04:00

handlers_reports.go

feat(report): Insights buckets days in the viewer's time zone (TASK-3524) (#1955)

2026-10-09 08:14:55 -04:00

handlers_restore_plan_limit_test.go

test(server): RED legs for item restore past items_per_workspace (BUG-3101)

2026-09-17 11:02:02 -04:00

handlers_role_board.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

handlers_search_collection_bug2659_test.go

fix(search): the collection filter resolves exact-first per workspace in scope, so a collection named task is no longer shadowed by tasks (BUG-2659, BUG-2839) (#1576)

2026-09-26 12:20:58 -04:00

handlers_search.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_sessions_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_sessions.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

handlers_share_attachments_derive_test.go

feat(web,server): render embedded image attachments on share pages via a variants-only byte endpoint (BUG-2389 2b, TASK-2637) (#1153)

2026-08-18 12:26:00 -04:00

handlers_share_attachments_test.go

fix(server): sign protected share-page images on every install (BUG-3305) (#1673)

2026-09-29 20:35:28 -04:00

handlers_share_attachments.go

fix(share): a share link serves nothing once its item or collection is archived (BUG-3635) (#2167)

2026-10-14 11:49:45 -04:00

handlers_share_links_bruteforce_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

handlers_share_links_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_share_links.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_stars_test.go

perf(web): tag and starred pages render from the local index (TASK-2231) (#1938)

2026-10-09 03:16:57 -04:00

handlers_stars.go

fix(api): children, starred and shared-collection lists are bounded at 1000 and paged; MCP starred caps at 300 (BUG-3789, BUG-3790, BUG-3792) (#2153)

2026-10-14 05:35:34 -04:00

handlers_storage_delete_authz_test.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_storage_test.go

feat(attachments): Settings → Storage tab with attachment list (TASK-882) (#303)

2026-04-29 17:44:12 -04:00

handlers_storage.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_stream_gap_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_stream_session_liveness_test.go

fix(mcp): MCP's long-lived streams end with their credential (BUG-3837) (#2201)

2026-10-15 14:37:04 -04:00

handlers_tags_test.go

feat(tags): workspace tag enumeration endpoint + cross-collection filter (TASK-1653) (#658)

2026-05-29 23:43:02 -04:00

handlers_timeline_collapse_test.go

feat(import): mark rows a workspace import wrote, author not verified (BUG-3379) (#1755)

2026-10-03 05:18:30 -04:00

handlers_timeline_comment_agent_test.go

feat(server): timeline comment rows carry the agent name (TASK-2760) (#1196)

2026-08-24 18:09:02 -04:00

handlers_timeline_cursor_test.go

fix: timeline can answer has_more=true with zero entries, and the client cannot page past it (BUG-2765) (#1202)

2026-08-25 16:11:47 -04:00

handlers_timeline_cursor_validation_test.go

feat(store): make the NUL invariant a property of the DATABASE (DOC-2823 S2)

2026-09-01 21:16:17 +00:00

handlers_timeline_id_collision_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline_structured_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline.go

feat(items): pad item patch --undo, anchored on each edit's context (PLAN-3578 step 3) (#2058)

2026-10-11 09:28:08 -04:00

handlers_tokens_session_auth_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_tokens.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_ui_dismissals.go

feat: in-app tutorials on Pad Cloud, links to getpad.dev/learn elsewhere (TASK-3452) (#1839)

2026-10-06 22:23:29 -04:00

handlers_unparented_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_unsubscribe_test.go

fix(server): escape unsubscribe page via html/template + add strict CSP (TASK-657) (#185)

2026-04-21 22:53:27 -04:00

handlers_unsubscribe.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_verifications.go

feat(verify): verification evidence tied to a revision, slice 1 (TASK-3617) (#2228)

2026-10-19 10:25:43 -04:00

handlers_verify_email_test.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

handlers_versions.go

fix(store): legacy document version doors resolve from the body read in the same snapshot (BUG-3833) (#2198)

2026-10-15 12:22:37 -04:00

handlers_views_collections_jsonb_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_views_unparented_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_views.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_watch_access_test.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

handlers_watch_access.go

feat(push): the push dispatcher core and its privacy gates, not yet wired (TASK-3939, part B1) (#2280)

2026-10-22 00:38:26 -04:00

handlers_watch_events_cancel_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_oauth_scope_test.go

fix(server): an event stream whose client stops reading ends instead of pinning its handler (BUG-3637) (#2172)

2026-10-14 16:47:40 -04:00

handlers_watch_events_refused_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_watch_events.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

handlers_watch_notify.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_watch_vis_cache_test.go

fix(store): a role change or disable of a vanished user is 404, and the unguarded DisableUser is gone (BUG-3826) (#2196)

2026-10-15 08:23:56 -04:00

handlers_watches_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_watches.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_webhook_token_idor_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_webhooks_secret_test.go

test(webhooks): use a literal IP instead of example.com in two more spots

2026-07-26 23:56:34 +00:00

handlers_webhooks.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

handlers_webmcp_setting_test.go

feat(server): add webmcp_enabled platform setting + session flag (#763)

2026-06-24 22:28:34 -04:00

handlers_well_known.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

handlers_workspace_autoadd_race_test.go

test(store): SQLite interleaving for the auto-add statement (BUG-2792 review r2 P2)

2026-09-16 15:36:49 -04:00

handlers_workspace_cap_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

handlers_workspace_create_consent_test.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

handlers_workspace_import_autoadd_test.go

fix(workspaces): workspace import adds the new workspace to the importing OAuth connection, as create does (BUG-2794) (#1491)

2026-09-24 01:02:00 -04:00

handlers_workspace_import_nul_test.go

fix(store,server,cli): three defects from codex round 1 (BUG-2810)

2026-09-02 15:15:11 +00:00

handlers_workspace_import_plan_limit_test.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

handlers_workspace_import_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_workspace_mint_parity_test.go

fix(server,store): both workspace mint doors enforce their preconditions from one place (BUG-2809) (#1268)

2026-09-06 23:36:58 -04:00

handlers_workspace_tabs_test.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspace_tabs.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspaces_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_workspaces.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

idempotency_keys.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

import_nul_repair.go

fix(import): relation defaults in imported schemas point at the imported items (BUG-3658) (#2159)

2026-10-14 08:53:26 -04:00

import_outcomes.go

fix(server): an interrupted import rolls back, and its outcome can be asked for (BUG-3475) (#1867)

2026-10-07 21:03:24 -04:00

import_plan_limit_message_test.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

import_read_deadline.go

fix(import): a failed bundle import always reports its workspace, and the body is read under a per-Read deadline (BUG-3184) (#1497)

2026-09-24 03:44:26 -04:00

import_stale_bodies.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

interchange_golden_test.go

fix(import): bundle import remaps attachment references in version history, and on a kept partial import (BUG-3655, BUG-3656) (#2156)

2026-10-14 08:05:34 -04:00

isolated_client_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

item_lineage.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

item_moved_to_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

item_moved_to.go

feat(apps): the installed-app API door, ceiling and read routes (TASK-3401, SPEC-6 U6a) (#1771)

2026-10-04 09:51:29 -04:00

item_show_staged_decisions_test.go

feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)

2026-10-19 13:05:05 -04:00

library_option_widen.go

fix(server): refuse a collection schema that repeats or empties a field key or option (TASK-3539, PR B) (#2009)

2026-10-10 03:04:20 -04:00

listen_serve_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

main_test.go

perf(test): build the SQLite migration chain once per test binary (IDEA-1914) (#788)

2026-07-03 10:15:49 -04:00

materialize_recovery_links_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

materialize_recovery_test.go

fix(collab): stop appending the whole document to the op-log on every reconnect (BUG-3523) (#1965)

2026-10-09 10:42:55 -04:00

materialize_recovery.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

mcp_availability_payload_test.go

feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666)

2026-09-29 16:41:24 -04:00

mcp_capability_test.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

mcp_security_floor_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

mcp_stream_credential.go

fix(mcp): MCP's long-lived streams end with their credential (BUG-3837) (#2201)

2026-10-15 14:37:04 -04:00

mcp_stream_keepalive.go

fix(mcp): MCP's long-lived streams keep alive and take a stream admission slot (BUG-3835) (#2197)

2026-10-15 13:18:36 -04:00

mcp_tool_outcome_test.go

fix(mcp): a refused tool call is audited as denied, not ok (BUG-3879) (#2222)

2026-10-18 11:12:41 -04:00

mcp_tool_outcome.go

fix(mcp): a refused tool call is audited as denied, not ok (BUG-3879) (#2222)

2026-10-18 11:12:41 -04:00

metrics_auth_test.go

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

middleware_auth_admin_token_gate_test.go

fix(auth): scope admin platform role to cookie session auth (BUG-1616) (#632)

2026-05-27 10:09:30 -04:00

middleware_auth_public_paths_test.go

fix(auth): TokenAuth falls through invalid Bearer on public API paths (BUG-1227) (#434)

2026-05-07 20:01:34 -04:00

middleware_auth.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

middleware_compress_test.go

feat(server): gzip what the client accepts, except streams, upgrades, ranges and secrets (TASK-2225) (#1934)

2026-10-09 03:16:26 -04:00

middleware_compress.go

fix(server): /mcp middleware refusals get the response write deadline (BUG-3834) (#2199)

2026-10-15 09:28:16 -04:00

middleware_csrf_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

middleware_csrf.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

middleware_form_body_test.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_form_body.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_logging_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_logging.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

middleware_mcp_audit_test.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

middleware_mcp_audit.go

fix(mcp): a refused tool call is audited as denied, not ok (BUG-3879) (#2222)

2026-10-18 11:12:41 -04:00

middleware_mcp_auth_dual_read_test.go

fix(mcp): a connection row decides workspace access, not the legacy token list (BUG-3337) (#1749)

2026-10-02 22:03:29 -04:00

middleware_mcp_auth.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

middleware_mcp_body_limit.go

fix(server): cap the MCP request body at 7 MiB, answering 413 (BUG-3534) (#1988)

2026-10-09 19:48:36 -04:00

middleware_mcp_client.go

feat(mcp): count admitted MCP requests by method and client (TASK-2307) (#2003)

2026-10-10 00:50:31 -04:00

middleware_mcp_host_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_host.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_metrics_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_mcp_scope.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

middleware_mcp_session_test.go

feat(metrics): session-id-keyed TTL sweep for mcp_active_sessions (TASK-1120) (#400)

2026-05-03 17:40:18 -04:00

middleware_mcp_session.go

docs(mcp): the reason given for the protocol restriction was false — replace it with the true one (TASK-2977) (#1312)

2026-09-09 20:35:44 -04:00

middleware_metrics_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_metrics.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

middleware_query_test.go

fix: item lists refuse a filter key that names no field (BUG-3480) (#1880)

2026-10-08 10:43:33 -04:00

middleware_ratelimit_bug3308_test.go

fix(ratelimit): retention covers the full refill window, so an idle drained bucket is not reset (BUG-3638) (#2115)

2026-10-13 10:32:14 -04:00

middleware_ratelimit_bug3310_test.go

fix(server): one general API bucket per caller across both middleware arms (BUG-3310) (#1672)

2026-09-29 20:15:52 -04:00

middleware_ratelimit_bug3638_test.go

fix(ratelimit): retention covers the full refill window, so an idle drained bucket is not reset (BUG-3638) (#2115)

2026-10-13 10:32:14 -04:00

middleware_ratelimit_task3620_test.go

feat(server): the health probe gets its own per-address rate-limit tier, and the search burst is 30 (TASK-3620 PR B) (#2108)

2026-10-12 11:50:23 -04:00

middleware_ratelimit_test.go

feat(server): the health probe gets its own per-address rate-limit tier, and the search burst is 30 (TASK-3620 PR B) (#2108)

2026-10-12 11:50:23 -04:00

middleware_ratelimit.go

feat(server): chat HTTP API and access model (TASK-4039) (#2292)

2026-10-23 16:07:40 -04:00

middleware_realip_test.go

fix(server): resolve the client from the right-most untrusted X-Forwarded-For hop (BUG-3323) (#1700)

2026-09-30 23:19:41 -04:00

middleware_realip.go

fix(server): resolve the client from the right-most untrusted X-Forwarded-For hop (BUG-3323) (#1700)

2026-09-30 23:19:41 -04:00

middleware_request_text_test.go

fix(server): refuse invalid-UTF-8 and NUL query values at the transport (BUG-2784) (#1217)

2026-08-27 10:35:39 -04:00

middleware_request_text.go

fix: item lists refuse a filter key that names no field (BUG-3480) (#1880)

2026-10-08 10:43:33 -04:00

middleware_security_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

middleware_security.go

fix(server): reject CORS wildcard when credentials are on (TASK-664) (#188)

2026-04-21 23:59:54 -04:00

middleware_session_ip_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_session_ua_test.go

feat(security): enforce session UA binding under strict mode (TASK-2056) (#912)

2026-07-10 23:32:22 -04:00

middleware_verified_email_test.go

fix(invitations): a pending invitation dies with its inviter's authority (BUG-3770) (#2214)

2026-10-16 21:14:10 -04:00

middleware_verified_email.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

middleware_write_deadline.go

fix(server): /mcp middleware refusals get the response write deadline (BUG-3834) (#2199)

2026-10-15 09:28:16 -04:00

migrate_close_state.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

mobile_contract_test.go

test(server): the mobile shells' unversioned contracts fail CI when they move (TASK-2053) (#1294)

2026-09-08 15:49:05 -04:00

my_invitations_test.go

fix: an invite asks an existing user instead of adding them; decline; CLI invitations (BUG-2136 U1) (#1831)

2026-10-06 12:16:32 -04:00

needs_scorers_test.go

feat(needs): sort=importance|simplicity with a score-keyed cursor (TASK-3959, part 2) (#2274)

2026-10-21 12:38:23 -04:00

needs_scorers.go

feat(needs): importance and simplicity scorers on /me/needs (TASK-3959, part 1b) (#2273)

2026-10-21 10:46:44 -04:00

nul_differential_test.go

feat(server,store): the differential test's three live legs + the 400 mapping

2026-09-01 12:06:08 +00:00

nul_repair_differential_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

oauth_iss_test.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

oauth_iss.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

oauth_sweep_test.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

oauth_sweep.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

open_children_guard_pool_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

oplog_compaction.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

oplog_gc_test.go

feat(collab): periodic op-log GC sweeper for dormant items (TASK-1309) (#471)

2026-05-09 18:19:33 -04:00

oplog_gc.go

feat(collab): the GC compacts dormant op-logs and a covered resume merges (TASK-3531 U3-U5) (#1985)

2026-10-09 20:32:46 -04:00

orphan_gc_test.go

fix(server): rowless-blob GC sweep — reclaim blobs no attachments row references (BUG-2406) (#1137)

2026-08-17 09:03:44 -04:00

orphan_gc.go

fix(attachments): a refused upload, transform or import reclaims the blob it wrote (BUG-3652) (#2118)

2026-10-13 13:24:49 -04:00

outbox_drain_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

outbox_drain.go

feat(apps): app webhook delivery behind an in-flight fence, signature v2 (TASK-3408, SPEC-6 U10b) (#1780)

2026-10-04 20:35:13 -04:00

outbox_payload_limit_test.go

docs,test(store): correct five comments and strengthen the shrink fixture (BUG-2827)

2026-09-02 12:05:57 +00:00

overdue_surfaces_test.go

fix(server): an ordinary open backlog fills Up next and pad project ready (BUG-3453) (#1854)

2026-10-07 08:36:58 -04:00

overdue.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

password_strength_test.go

fix(web): state the password rule on every password field, and show its refusal there (TASK-2260) (#1941)

2026-10-09 04:22:31 -04:00

password_strength.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

pinned_token.go

fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)

2026-10-21 02:43:37 -04:00

plan2348_timeline_drops_test.go

fix(history): split activity runs by source, stamp version source, stop dropping field changes (PLAN-2348 U1) (#1685)

2026-09-30 06:50:13 -04:00

plan2348_timeline_kinds_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

plan2348_u2_versions_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

plan2348_version_source_test.go

fix(history): split activity runs by source, stamp version source, stop dropping field changes (PLAN-2348 U1) (#1685)

2026-09-30 06:50:13 -04:00

plan3535_reference_exclusion_test.go

feat(server): reference items stop counting as open work (PLAN-3535 PR 2) (#2000)

2026-10-09 22:31:16 -04:00

plan3535_tracks_work_test.go

feat: a collection can be reference material, not work (PLAN-3535 PR 1) (#1996)

2026-10-09 21:47:50 -04:00

plan3555_unguarded_write_test.go

feat(items): agent body writes are version-checked by default, phase 1: count, warn, replace (PLAN-3555) (#2054)

2026-10-11 05:29:53 -04:00

plan3578_patch_room_test.go

feat(items): pad item patch --undo, anchored on each edit's context (PLAN-3578 step 3) (#2058)

2026-10-11 09:28:08 -04:00

plan3578_patch_test.go

feat(items): content-anchored patch writes on an item with no live editor (PLAN-3578 step 1) (#2055)

2026-10-11 06:20:09 -04:00

plan3578_retro_fixes_test.go

fix(items): undo of an emptied line; a patch that changes nothing is refused (PLAN-3578 retro fixes 5+6) (#2089)

2026-10-11 21:10:03 -04:00

plan3578_undo_test.go

feat(items): pad item patch --undo, anchored on each edit's context (PLAN-3578 step 3) (#2058)

2026-10-11 09:28:08 -04:00

plan3598_item_context_test.go

fix(server): item context fills its budget past a part that does not fit, orders conventions by relevance, and widens implement to commit and PR rules (PLAN-3598) (#2101)

2026-10-12 08:27:13 -04:00

plan_limit_native_shell_test.go

fix(test): call SetUserPlan with a PlanWrite; main broken since 1ed52bdb (TASK-3293) (#1659)

2026-09-29 11:28:17 -04:00

progress_abandoned_test.go

fix(progress): an abandoned child leaves both the done count and the total, and 0/0 renders as no progress (BUG-3195) (#1510)

2026-09-24 11:24:33 -04:00

publish_sites_ruled_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

push_dispatch.go

feat(server): push dispatch timings are configurable, and a bad value refuses startup (TASK-3939) (#2288)

2026-10-22 20:38:25 -04:00

push_gates.go

fix(store): a same-user push re-register keeps the device's created_at and row (TASK-4027) (#2281)

2026-10-22 02:27:28 -04:00

push_message_collapse_test.go

feat(web): push-to-agent composer in the item view (TASK-2561) (#1099)

2026-08-15 08:22:09 -04:00

redis_health_test.go

fix(watchevents,server): four concurrency findings from codex round 9 (BUG-2727, BUG-2726)

2026-08-22 03:43:15 +00:00

redis_health.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

relation_backlinks_test.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

relation_hydration.go

fix(server): lineage and closure name only items the caller may see (#1743)

2026-10-02 18:49:07 -04:00

relation_multi_roundtrip_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_ref_prefix_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_referents_doors_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_referents.go

feat(apps): app install provisioning, install codes and redeem (TASK-3397, SPEC-6 U8b) (#1772)

2026-10-04 11:59:42 -04:00

relation_target_availability.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_titles_copy_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

relation_titles_doors_test.go

test(server): run the heaviest serial tests in parallel, and stop three of them migrating a fresh store (TASK-3493) (#1891)

2026-10-08 12:51:37 -04:00

relation_titles_import_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_unjudged_fail_closed_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

reminder_tick.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

reserved_seed_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

role_item_counts.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

server_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

server.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_activity_corrupt_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_activity_decode_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_activity_ordering_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_activity_scope_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_activity.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_identity_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_identity.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_presence_keys_test.go

feat(redis): namespace every Redis keyspace from one shared config value (BUG-2724)

2026-08-22 01:41:31 +00:00

session_presence_namespace_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

session_presence_redis_round2_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_presence_redis_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

session_presence_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

share_item_field_defs_test.go

fix(web,server): a direct item share labels and colours its field chips like a collection share, from defs that disclose only what the item shows (TASK-2248 U3) (#1587)

2026-09-26 20:13:56 -04:00

share_page_collab_isolation_test.go

fix(share): a shared item body is sanitized with the markdown allowlist, and the SPA CSP restricts form-action (BUG-3669) (#2145)

2026-10-14 02:04:58 -04:00

sse_stream.go

fix(server): a failed flush reaches the handler through chi's wrappers (BUG-3827) (#2186)

2026-10-15 01:02:42 -04:00

stream_admission_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

stream_admission.go

fix(mcp): MCP's long-lived streams keep alive and take a stream admission slot (BUG-3835) (#2197)

2026-10-15 13:18:36 -04:00

stream_credential_liveness.go

fix(mcp): MCP's long-lived streams end with their credential (BUG-3837) (#2201)

2026-10-15 14:37:04 -04:00

stream_gap_announcer_test.go

test: close the mutation gaps a coverage audit named (BUG-2730, codex round 18)

2026-08-23 02:32:43 +00:00

stream_gap_announcer.go

revert(sse): remove the ordering barrier; its failure mode is worse than the problem (BUG-2730, codex round 16)

2026-08-23 02:16:35 +00:00

task772_dashboard_visibility_test.go

test(server): the dashboard shows each caller only what they may see, in every section (TASK-772) (#1976)

2026-10-09 13:11:55 -04:00

task798_demotion_grandfathering_test.go

test(server): a demotion to free grandfathers existing work and is audited (TASK-798) (#1982)

2026-10-09 14:40:57 -04:00

task1069_mcp_blocked_test.go

fix(mcp): cloud refuses to start without an https origin for MCP OAuth; a blocked self-hosted MCP says so (TASK-1069) (#1920)

2026-10-08 21:23:12 -04:00

task1071_consent_identity_test.go

fix(oauth): the consent screen names Pad, the instance, the user's workspaces and the return host (TASK-1071) (#2017)

2026-10-10 09:15:51 -04:00

task1809_lease_agent_default_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

task2188_field_usage_test.go

feat: schema edits say what they do to items; removing an option is never a rename (TASK-2188, TASK-2187) (#1877)

2026-10-08 08:29:44 -04:00

task2189_collection_restore_test.go

feat: archived collections can be listed, restored and undone; the archive confirm shows the count (TASK-2189) (#1874)

2026-10-08 03:59:26 -04:00

task2190_totp_disable_test.go

fix: owners cannot lock themselves out by mistake; accounts with no password can set one and turn 2FA off (TASK-2190) (#1879)

2026-10-08 07:41:35 -04:00

task2197_sse_heartbeat_test.go

test(server): the busy-stream heartbeat test judges each heartbeat, not a load-dependent premise (BUG-3503) (#1907)

2026-10-08 17:35:17 -04:00

task2219_activity_collection_test.go

feat(activity): the collection and actor filters run on the server, and the web/CLI badge says which (TASK-2219) (#1948)

2026-10-09 06:36:13 -04:00

task2253_cli_auth_deny_test.go

feat(auth): Deny and request context on the CLI sign-in approval page (TASK-2253) (#1943)

2026-10-09 05:04:19 -04:00

task2257_convention_mirror_test.go

fix: a convention's stored metadata copy follows its ordinary fields (TASK-2257) (#1964)

2026-10-09 09:38:42 -04:00

task2307_mcp_request_counter_test.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

task2308_mcp_scope_test.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

task2863_read_scope_run_test.go

feat(server): a read-scoped token may run a playbook (TASK-2863) (#1987)

2026-10-09 18:56:44 -04:00

task2864_search_archived_test.go

feat(search): include_archived on /search, and an is:archived search token (TASK-2864) (#2001)

2026-10-09 23:10:51 -04:00

task3319_attachment_uploaded_test.go

feat(attachments): the viewer says when a file was uploaded, and by whom (TASK-3319) (#1697)

2026-09-30 16:49:25 -04:00

task3321_u1b_chatgpt_versions_test.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

task3321_u2a_audience_test.go

feat(mcp): scope in the /mcp challenge, and a 403 insufficient_scope for read-only OAuth writes (TASK-2308) (#1986)

2026-10-09 16:38:39 -04:00

task3321_u2b_mount_test.go

fix(mcp): a /mcp stream whose client stops reading ends instead of pinning its handler (BUG-3808) (#2182)

2026-10-15 06:06:34 -04:00

task3351_social_claim_test.go

fix(store): an unlink re-checks that a sign-in method remains under the account lock (BUG-3816) (#2191)

2026-10-15 17:23:24 -04:00

task3352_invitation_proof_test.go

fix(store): a role change or disable of a vanished user is 404, and the unguarded DisableUser is gone (BUG-3826) (#2196)

2026-10-15 08:23:56 -04:00

task3363_resource_missing_test.go

feat(oauth): count and log requests that omit the RFC 8707 resource (TASK-3363 phase 1) (#1748)

2026-10-02 20:54:40 -04:00

task3365_access_kick_test.go

test: the stalled-transport test waits for the worker to be inside Publish before clearing the transport (BUG-3464) (#1850)

2026-10-07 05:09:33 -04:00

task3365_kick_door_census_test.go

fix(mcp): MCP's long-lived streams end with their credential (BUG-3837) (#2201)

2026-10-15 14:37:04 -04:00

task3376_editor_grant_escalation_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

task3376_system_collection_surfaces_test.go

fix(access): system collections are ordinary collections for restricted members (TASK-3376) (#1756)

2026-10-03 09:19:10 -04:00

task3389_owner_webhook_strip_test.go

feat(auth): the bot principal for installed apps: users.kind, kind gates on every sign-in door and credential, people-only counts (TASK-3392) (#1766)

2026-10-03 19:41:18 -04:00

task3392_bot_principal_test.go

feat(auth): the bot principal for installed apps: users.kind, kind gates on every sign-in door and credential, people-only counts (TASK-3392) (#1766)

2026-10-03 19:41:18 -04:00

task3394_install_tokens_test.go

feat(oauth): delegated sign-in for installed apps through the issuance barrier, shipped closed (TASK-3399, SPEC-6 U5b-1) (#1779)

2026-10-04 19:22:21 -04:00

task3397_lifecycle_test.go

feat(apps): app install lifecycle: two-phase disable and rotate, re-enable, uninstall with the tombstone (TASK-3397, SPEC-6 U8c) (#1775)

2026-10-04 14:41:45 -04:00

task3399_delegated_flow_test.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

task3399b_delegated_api_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

task3401_app_api_test.go

fix(account): account export reads run inside the deadline, from one snapshot per workspace (BUG-3659) (#2160)

2026-10-14 10:09:13 -04:00

task3401b_app_writes_test.go

feat(apps): the app API admits a person's delegated token (TASK-3399, SPEC-6 U5b-2) (#1782)

2026-10-04 22:57:52 -04:00

task3401c_app_attachments_test.go

feat(apps): app attachment routes: item-scoped upload, metadata, and a streamed download re-admitted before its first byte (TASK-3401, SPEC-6 U6c) (#1776)

2026-10-04 15:14:27 -04:00

task3409_owner_delivery_test.go

feat(webhooks): owner webhooks keep per-endpoint delivery state; 408/425/429 are retried (TASK-3409) (#1809)

2026-10-05 14:44:50 -04:00

task3413_via_app_test.go

feat(apps): human-facing JSON names the app that wrote an item, comment or version (TASK-3413, SPEC-6 U9c) (#1787)

2026-10-05 04:49:25 -04:00

task3413a_app_list_test.go

feat(apps): Settings → Apps: install review, install-code handoff, and lifecycle controls (TASK-3413, SPEC-6 U9a) (#1785)

2026-10-05 03:53:12 -04:00

task3413b_install_artifacts_test.go

feat(apps): upgrade review and draft activation in Settings → Apps (TASK-3413, SPEC-6 U9b) (#1789)

2026-10-05 06:09:12 -04:00

task3414_item_actions_test.go

fix(apps): an installed app learns its workspace from the redeem, an unscoped /me and every webhook (BUG-3416) (#1797)

2026-10-05 09:16:24 -04:00

task3452_tutorials_test.go

feat: in-app tutorials on Pad Cloud, links to getpad.dev/learn elsewhere (TASK-3452) (#1839)

2026-10-06 22:23:29 -04:00

task3462_builtin_origin_test.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

task3462_builtin_update_test.go

feat: built-ins record their origin; an item made from one can be offered Pad's current text (TASK-3462 U1+U2) (#1852)

2026-10-07 06:40:06 -04:00

task3462_u3a_bootstrap_count_test.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

task3462_u3a_registry_sweep_test.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

task3462_u3a_replaced_fields_test.go

feat: built-in update count in the bootstrap, and accepted updates record replaced fields (TASK-3462 U3a) (#1868)

2026-10-07 21:29:37 -04:00

task3462_u3b_state_current_test.go

feat(web): review and accept built-in updates from the Library page and the item pane (TASK-3462 U3b) (#1873)

2026-10-08 02:53:41 -04:00

task3462_u3c_capability_test.go

feat(cli): pad library diff and pad library update for built-in conventions and playbooks (TASK-3462 U3c) (#1875)

2026-10-08 05:05:04 -04:00

task3462_u4_legacy_adoption_test.go

feat: adopt pre-origin conventions and playbooks as built-ins, once, by exact title (TASK-3462 U4) (#1878)

2026-10-08 06:55:33 -04:00

task3517_sort_order_test.go

feat: bulk sort_order: one all-or-nothing request per lane reorder, one activity row per item collapsed per batch (TASK-3517) (#1933)

2026-10-09 02:04:52 -04:00

task3524_report_tz_test.go

feat(report): Insights buckets days in the viewer's time zone (TASK-3524) (#1955)

2026-10-09 08:14:55 -04:00

task3528_app_association_test.go

test(server): the binary serves no app association file (TASK-3528) (#1967)

2026-10-09 10:01:26 -04:00

task3531_compaction_test.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

task3539_schema_uniqueness_test.go

fix(server): refuse a collection schema that repeats or empties a field key or option (TASK-3539, PR B) (#2009)

2026-10-10 03:04:20 -04:00

task3541_watermark_stamp_metric_test.go

feat(collab): count and log watermark stamps that cover content-bearing rows (TASK-3541 step 0) (#2023)

2026-10-10 11:54:42 -04:00

task3549_stripe_customer_cas_test.go

feat(cloud): the Stripe customer link is compare-and-set, and readable by user (TASK-3549) (#2027)

2026-10-10 15:59:17 -04:00

task3564_billing_users_test.go

feat(cloud): GET /admin/billing-users pages the users the reconcile sweep re-syncs (TASK-3564, pad half) (#2042)

2026-10-10 23:11:23 -04:00

task3574_incomplete_recovery_test.go

fix(collab): recovery refuses an incomplete op-log replay, and a failed compaction snapshot keeps the log (TASK-3574 (1) and (3)) (#2045)

2026-10-11 01:23:31 -04:00

task3574_step2_recovery_test.go

fix(collab): recovery replays SyncStep2 rows, which can hold the only copy of an edit (TASK-3574 (2)) (#2046)

2026-10-11 00:07:56 -04:00

task3585_append_key_test.go

feat(items): idempotency keys for comments, notes and decisions; idempotency_target_gone is structured (TASK-3585) (#2068)

2026-10-11 14:38:15 -04:00

task3585_comment_key_test.go

feat(items): idempotency keys for comments, notes and decisions; idempotency_target_gone is structured (TASK-3585) (#2068)

2026-10-11 14:38:15 -04:00

task3585_copy_key_test.go

feat(items): idempotency keys for cross-workspace copy and move (TASK-3585) (#2070)

2026-10-11 15:59:02 -04:00

task3585_copy_replay_authz_test.go

fix(items): a keyed replay of an archived-source move re-checks the destination (TASK-3585) (#2087)

2026-10-11 20:34:11 -04:00

task3585_create_key_test.go

feat(items): idempotency keys for item create (TASK-3585) (#2065)

2026-10-11 13:06:44 -04:00

task3585_create_limit_test.go

fix(items): a keyed create claims its key before the plan-limit check (TASK-3585) (#2088)

2026-10-11 20:34:31 -04:00

task3585_patch_key_test.go

feat(items): idempotency keys for patch writes (TASK-3585) (#2062)

2026-10-11 11:33:30 -04:00

task3585_push_key_test.go

feat(push): idempotency keys for push, and the monitor drops a re-published push (TASK-3585) (#2071)

2026-10-11 16:44:56 -04:00

task3595_signup_landing_test.go

feat(auth): a first Cloud signup lands in its new workspace; OAuth comes first (TASK-3595) (#2075)

2026-10-11 18:09:29 -04:00

task3601_payer_details_test.go

feat: a plan-limit refusal is a persistent prompt that names the limit and who can lift it (TASK-3601) (#2080)

2026-10-11 18:39:37 -04:00

task3604_search_workspace_test.go

feat: predictable palette search scope; "All" searches every workspace you can see (TASK-3604) (#2085)

2026-10-11 19:48:40 -04:00

task3611_reminder_oracle_test.go

feat(mcp): pad_item reminders lists an item's reminders and unremind disarms one (TASK-3611) (#2097)

2026-10-12 03:18:50 -04:00

task3613_lease_worker_test.go

feat(lease): an opaque worker id holds item leases, so two agents under one name do not share one (TASK-3613) (#2102)

2026-10-12 09:24:33 -04:00

task3615_activity_since_test.go

feat(web): catch-up card, Mark caught up, and See everything into Activity (TASK-3615, PR B) (#2226)

2026-10-18 14:42:40 -04:00

task3615_catch_up_test.go

feat(server): per-user catch-up digest and read cursor (TASK-3615, PR A) (#2219)

2026-10-18 12:12:51 -04:00

task3617_verifications_test.go

feat(verify): verification evidence tied to a revision, slice 1 (TASK-3617) (#2228)

2026-10-19 10:25:43 -04:00

task3618_item_context_decisions_test.go

feat(server): the item brief carries only the decisions Pad would surface, and counts the rest (TASK-3618) (#2107)

2026-10-12 11:53:29 -04:00

task3619_storage_cap_test.go

feat(storage): enforce plan storage limits at upload; Pro 1 GB pooled per account, Free 100 MB (TASK-3619) (#2110)

2026-10-12 15:12:36 -04:00

task3866_token_scopes_create_test.go

feat(web): choose an API key's access when creating it, and see every key's access (TASK-3866) (#2216)

2026-10-17 06:13:14 -04:00

task3917_mention_shape_test.go

feat(store): @mention index on comments (TASK-3917) (#2243)

2026-10-19 23:27:16 -04:00

task3919_awaits_human_test.go

feat(collections): awaits_human collection setting (TASK-3919) (#2244)

2026-10-19 19:58:46 -04:00

task3926_funnel_metrics_test.go

feat(metrics): signup and first-write funnel metrics; TouchUserWrite reports the first write (TASK-3926) (#2227)

2026-10-18 23:25:22 -04:00

task3939b2a_push_test.go

feat(push): summary push, 30/h cap, retry matrix and expire/prune sweeps (TASK-3939 part B2a) (#2283)

2026-10-22 09:10:56 -04:00

task3939b2b_notification_test.go

feat(push): GET /me/notifications/{id} enrichment and the real-enqueue mention leg (TASK-3939 part B2b) (#2284)

2026-10-22 12:04:46 -04:00

task3939b_push_dispatch_test.go

feat(server): push dispatch timings are configurable, and a bad value refuses startup (TASK-3939) (#2288)

2026-10-22 20:38:25 -04:00

task3939b_push_fixture_test.go

fix(store): push token ownership follows a registration sequence, not updated_at (TASK-4031) (#2282)

2026-10-22 05:25:18 -04:00

task3939b_push_gates_test.go

fix(push): bound re-sends when the sent record fails after a gateway 'sent' (TASK-4032) (#2285)

2026-10-22 15:02:07 -04:00

task3946_mention_editor_test.go

feat(store): @mentions enqueue a push notification (TASK-3946) (#2272)

2026-10-21 10:12:15 -04:00

task3975_cli_token_lifetime_test.go

fix(auth): a browser-approved CLI token gets its own lifetime (TASK-3975) (#2252)

2026-10-20 13:30:31 -04:00

task4027_push_reregister_test.go

test(server): the re-register test's row no longer sits on the expiry boundary (BUG-4033) (#2289)

2026-10-22 21:48:27 -04:00

task4032_push_record_failure_test.go

fix(push): bound re-sends when the sent record fails after a gateway 'sent' (TASK-4032) (#2285)

2026-10-22 15:02:07 -04:00

task4040_activity_registry_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

task4040_presence_test.go

feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)

2026-10-23 19:46:02 -04:00

task4054_chat_agent_separation_test.go

test(chat): sibling-DM coverage for inbox, unread and ensure (TASK-4060) (#2299)

2026-10-24 06:10:59 -04:00

testimageprocessor_libvips_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

testimageprocessor_purego_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

token_reaper_test.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

token_reaper.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

token_scope_levels_test.go

feat(web): choose an API key's access when creating it, and see every key's access (TASK-3866) (#2216)

2026-10-17 06:13:14 -04:00

token_scopes_test.go

feat(oauth): MCPBearerAuth OAuth integration + public-info (TASK-1027) — closes TASK-951 (#375)

2026-05-02 13:33:53 -04:00

token_workspace_allowlist_test.go

fix(security): scope MCP workspace-global reads by OAuth consent allow-list (BUG-2102) (#935)

2026-07-14 20:37:03 -04:00

token_workspace_consent_scope_test.go

fix(workspaces): reorder skips workspaces outside the OAuth consent allow-list, as the list endpoint does (BUG-3255) (#1614)

2026-09-27 12:01:55 -04:00

tutorials.go

feat: in-app tutorials on Pad Cloud, links to getpad.dev/learn elsewhere (TASK-3452) (#1839)

2026-10-06 22:23:29 -04:00

twofactor_challenge.go

fix(auth): a verification link verifies only for its account's session; the mailbox owner can claim (BUG-3382) (#1758)

2026-10-03 09:48:19 -04:00

username.go

feat: username validation, reserved words, and registration flow

2026-04-10 23:12:59 +00:00

web_build_identity_test.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

web_build_identity.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

workspace_access_notify_test.go

fix(server): a watch stream resolves each workspace slug once per tick, not per notification (BUG-3773) (#2210)

2026-10-16 09:58:53 -04:00

workspace_access_notify.go

feat(server): revoking access re-checks live connections immediately (#1744)

2026-10-02 19:43:19 -04:00

workspace_mint.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

workspace_owner_compensation_test.go

fix(invitations): a pending invitation dies with its inviter's authority (BUG-3770) (#2214)

2026-10-16 21:14:10 -04:00

workspace_owner_compensation.go

fix(server): removeUnusableWorkspace reports a failed delete as kept (BUG-3479) (#1870)

2026-10-07 23:39:39 -04:00

workspace_purge_test.go

feat(store): hard-purge soft-deleted workspaces after 30 days (TASK-1966) (#825)

2026-07-05 22:23:12 -04:00

workspace_purge.go

feat(appstore): app attachment upload, read rule and caps behind FencedTx (TASK-3396, U7a) (#1768)

2026-10-03 21:31:44 -04:00