* refactor(ui): share neutral capability contracts across editions
Move SiriusCapability, SiriusPrincipal, the capability snapshot/provider types,
and the Community catalog into a React-free contracts module so the browser
registry and the incoming server registry cannot hold divergent catalogs. The UI
extension modules re-export the same names, so consumers are unchanged.
Pin the Community catalog to documentation/product/edition-boundary.yaml with a
contract test, since that file is the source of truth for the edition boundary.
Co-authored-by: mtoussain <mtoussain@gmail.com>
* feat(ui): add server principal resolver and tRPC extension seam
Mirror the browser extension registry on the server. A SiriusServerExtension
declares tRPC namespaces with their required capabilities, at most one principal
resolver, and optional session enrichers; registered.ts is the build-time
overlay a private build replaces.
protectedProcedure now enforces the capabilities declared for the procedure's
namespace, so a contributed namespace is authorized without patching Core
procedures. Principal resolution fails closed: a resolver that throws yields no
principal instead of inheriting another edition's capability set. Community
resolves any authenticated session to its static catalog, leaving Community
behavior unchanged.
root.ts cross-checks declared namespaces against the composed router in both
directions, so an overlay that ships a router without declaring it (or declares
a namespace it never serves) fails at startup rather than at request time. The
routers stay object literals so tRPC keeps inferring client types.
Co-authored-by: mtoussain <mtoussain@gmail.com>
* test(ui): run extension contract tests in CI
Add the server and capability suites alongside the UI registry suite behind a
single test:extensions script, and make it a blocking CI step so the contracts
private builds overlay are actually guarded.
Co-authored-by: mtoussain <mtoussain@gmail.com>
* docs: record the server-side extension seam in ADR-004 and the task board
Co-authored-by: mtoussain <mtoussain@gmail.com>
* fix(server): allow private principal resolver to replace Community fallback
* test(server): prove private resolver can replace Community fallback
* docs: record resolver replacement semantics and freeze server contracts at v1
Co-authored-by: mtoussain <mtoussain@gmail.com>
* fix(server): split overlay router slot out of the declaration slot
Contributing routers from registered.ts cycles: trpc.ts imports the registry to
enforce capabilities, so an overlay router module importing createTRPCRouter
loads while trpc.ts is still initializing and dies with 'Cannot access
createTRPCRouter before initialization'. This was found by composing a private
extension against the seam.
Routers now come from registered-routers.ts, which only root.ts imports, so they
load after trpc.ts is ready. root.ts still cross-checks declared namespaces
against composed ones, and a contract test keeps the declaration modules free of
tRPC imports.
Co-authored-by: mtoussain <mtoussain@gmail.com>
* docs: document the overlay module split and cycle constraint
Co-authored-by: mtoussain <mtoussain@gmail.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Follow up #149 by routing capability loads through a directly testable helper and proving network, HTTP, and malformed-payload failures retain the fail-closed snapshot and deny gated capabilities.
Implement the public build-time UI extension registry and neutral principal/capability provider for Core Phase 3.4.
Includes deterministic extension ordering and collision validation, Community route/sidebar migration, capability-gated rendering, and fail-closed defaults for API-backed capability providers.
Part of #147 and #148; server-side auth/tRPC extension seams remain follow-on work.
* docs(program): adopt class-ready Pro-dev cutover track
Stop blocking range readiness on unfinished Phase 3–6 contracts; document a companion Pro-dev stack that preserves Community independence.
* docs(program): reframe class-ready cut as private build root
Success is sirius-pro as the sole mutable Compose/build root on the range
with locked Community digests on :3000/:9001; companion sidecars alone do not
satisfy the cutoff.
Compare candidates against the protected merge-base/PR-base OpenAPI via
oasdiff, harden Fiber shadow detection and middleware test isolation, and
align /api/v1 input and status claims with handlers.
Reorder shadowed Fiber routes, add semantic OpenAPI baseline breaking
checks, share production middleware in tests, tighten health auth skip,
and align request/response contract details with live handlers.
Add a machine-readable classification for every live Community route, a
versioned /api/v1 OpenAPI document with reserved Pro/internal namespaces,
and blocking CI coverage checks that preserve the task 3.1 route inventory.
Image-layer nested tar no longer rejects absolute in-container symlink
targets; links are skipped without following while regular path checks
and source-release link rejection remain fail-closed.
Charge each representation once so raw pre-scans do not triple-count
when gzip/tar/zip nesting succeeds. Large members still stream-recurse
into nested archives with spooling and safety caps.
Avoid full-buffer gzip/layer decompression and hard-failing large
members; chunk-scan with overlap and budgets. Opportunistic source
nesting skips malformed magic without losing raw findings; explicit
archive/image modes stay fail-closed.
Prove public Community needs no private credentials or packages by scanning
source, release archives, SBOMs, and digest images with path-scoped allowlists
and synthetic canaries (task 2.3 / bifurcation.s3.t008).
Add fail-closed attest-release-images to the Community release train so
all six inventory digests get CycloneDX SBOMs and keyless Cosign verify
before a GitHub Release can publish. Contract tests lock the ordering,
digest-only inputs, asset names, and OIDC permissions.
Pin the go-api migration hotfix that indexes the persisted v_id column so clean databases can complete the deterministic migration ledger in integration CI.
Matthew Toussain