xarmian 25b687a6cf test(schema): scope the decode guard by MODULE PATH, not by vendor location (BUG-2685 follow-up) (#1381) ...

The Nix red was fixed at 9ece3e4f by skipping vendor/ paths. This is the
predicate the lead asked for in the same breath and the one that is exact:
packages.Visit walks the whole DEPENDENCY GRAPH, so what disqualifies a site is
that its package does not belong to this module — not where its files happen to
sit. Adds the invariant assertion on real output (nothing enumerated may be
vendored or outside the tree) and a table test for both path predicates.

Measured rather than claimed: with a vendored tree each check ALONE suffices, so
neither mutant dies alone. Both are kept because they answer different
questions, and the comment says so.

Claude-Session: https://claude.ai/code/session_019EmDd3Wy8b3cPG1TZBSzBu

2026-09-15 01:36:56 -04:00

..

testdata/decodeshapes

fix(schema): a grandfathered reserved-key FieldDef never reaches an item-field path (BUG-2685) (#1377)

2026-09-15 00:50:12 -04:00

activity.go

fix: timeline can answer has_more=true with zero entries, and the client cannot page past it (BUG-2765) (#1202)

2026-08-25 16:11:47 -04:00

agent_role.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

api_token.go

feat: add API token rotation, expiry defaults, and scope enforcement

2026-04-08 18:00:43 +00:00

attachment.go

feat(store): attachments table + Attachment model (TASK-869) (#286)

2026-04-29 11:34:35 -04:00

backlink.go

fix(items): eleven hand-built doors carry the stale-body marker (BUG-3033) (#1344)

2026-09-13 18:34:16 -04:00

collection_schema_item_fields.go

fix(schema): a grandfathered reserved-key FieldDef never reaches an item-field path (BUG-2685) (#1377)

2026-09-15 00:50:12 -04:00

collection_traits_test.go

feat(store,server,web): collection kernel traits — de-hardcode conventions/playbooks slugs (TASK-2657, BUG-2702) (#1171)

2026-08-20 13:26:05 -04:00

collection_traits.go

feat(store,server,web): collection kernel traits — de-hardcode conventions/playbooks slugs (TASK-2657, BUG-2702) (#1171)

2026-08-20 13:26:05 -04:00

collection.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

comment.go

feat(server): timeline comment rows carry the agent name (TASK-2760) (#1196)

2026-08-24 18:09:02 -04:00

connected_apps.go

feat(oauth): backfill session.Extra into oauth_connections + switch read path (TASK-1522) (#583)

2026-05-18 03:32:42 -04:00

document_title_test.go

docs(links,store,models): cite markdown.ts by symbol, and check it (BUG-2832)

2026-08-31 23:24:27 +00:00

document.go

docs(links,store,models): cite markdown.ts by symbol, and check it (BUG-2832)

2026-08-31 23:24:27 +00:00

export.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

grant.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

invitation_test.go

feat(auth): expire workspace invitations after 14 days (TASK-649) (#176)

2026-04-21 20:08:05 -04:00

item_appendable_agreement_test.go

fix(server,mcp,cli): refuse system-metadata keys in fields_patch + retry-hostile error code (BUG-2627 part 2, BUG-2675) (#1166)

2026-08-19 23:17:24 -04:00

item_links_test.go

feat(links): add lineage relationships for TASK-121 (#39)

2026-04-02 09:45:41 -04:00

item_links.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

item_test.go

fix(models): refuse an append that would destroy an unreadable structured field (BUG-2627, part 3) (#1164)

2026-08-19 13:26:55 -04:00

item_workspace_move.go

feat(store): add item_workspace_moves provenance table (TASK-2356)

2026-07-30 12:20:38 +00:00

item.go

fix(items): an injected schema default takes the same type check a supplied value takes (BUG-3079) (#1362)

2026-09-14 09:03:24 -04:00

mcp_audit.go

feat(mcp): persistent audit log for /mcp tool calls (TASK-960) (#389)

2026-05-02 22:56:10 -04:00

oauth.go

feat(oauth): schema + storage layer (TASK-1023, sub-PR A of TASK-951) (#370)

2026-05-02 10:25:53 -04:00

relation_field_types_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_target_set_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

reminder.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

report_layout.go

feat(insights): per-user layout customization + persistence (TASK-1634) (#645)

2026-05-29 15:00:34 -04:00

reserved_field_decode_guard_test.go

test(schema): scope the decode guard by MODULE PATH, not by vendor location (BUG-2685 follow-up) (#1381)

2026-09-15 01:36:56 -04:00

share_link.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

snapshot.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

status_transition.go

feat(store): structured status-transition log + backfill (TASK-1637) (#637)

2026-05-29 06:55:47 -04:00

templates.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

terminal_test.go

fix(server): stop counting disabled conventions as completed work (#1152)

2026-08-18 10:44:50 -04:00

terminal.go

fix(schema): a grandfathered reserved-key FieldDef never reaches an item-field path (BUG-2685) (#1377)

2026-09-15 00:50:12 -04:00

user_test.go

feat(store): add users.email_verified_at column + model plumbing (TASK-1935) (#805)

2026-07-04 00:45:48 -04:00

user.go

feat(store): add users.email_verified_at column + model plumbing (TASK-1935) (#805)

2026-07-04 00:45:48 -04:00

version.go

Initial release

2026-03-26 01:52:36 +00:00

view.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

watch.go

feat(server,cli): watches, user-scoped event stream, plugin monitor command — PLAN-2469 Phase 1 (TASK-2533) (#1082)

2026-08-12 15:50:41 -04:00

webhook.go

fix(security): encrypt webhook HMAC secrets at rest, mask in responses (BUG-2057) (#915)

2026-07-11 00:10:27 -04:00

workspace_settings_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

workspace_settings.go

feat(workspaces): add CLI and API context support for TASK-130 (#46)

2026-04-02 16:10:09 -04:00

workspace.go

fix(ci): gofmt internal/models/workspace.go to unbreak Go job (BUG-1911) (#784)

2026-07-02 22:45:01 -04:00

yjs_update.go

feat(store): add Yjs op-log table + store methods (TASK-1252) (#450)

2026-05-08 13:28:55 -04:00