Adopt Slugkit 0.12.2 follow and contact fixes #30

Merged

erik merged 1 commit from task-c26ddfc5-follow-contact-fixes into main

2026-10-30 21:20:34 -05:00

erik commented

2026-10-30 21:18:01 -05:00

Owner

Summary

Adopts Safer follow and contact identity from pinned Slugkit release 47e382cfc1f06060546360aefa36d19e546423a0 (template ZIP 0.12.2, API package 1.1.0, compatible management contract 2.3.0).

Pin @evcraddock/slug-api to 1.1.0, update only that dependency in the lockfile, synchronize runtime/site metadata and verify the packaged OpenAPI/contract.
Adapt site-owned contact deletion and migration 031_detached_following_history.sql: only inactive history can detach, contact-owned accounts are cleaned up transactionally, active follows and unrelated references remain protected. Preserve following/incoming rows, snapshots, generation semantics, aliases, tombstones, cursor positions and sequence high-water marks. Detached history stays internal; explicit future follow can reattach the same following ID without resurrecting removed copies.
Adapt canonical/profile account reuse with reciprocal ActivityPub identity verification, exact contact-owned account matching, canonical metadata, explicit ambiguity errors, race rechecks and atomic persistence. Preserve site-specific primary-actor signing on every initial/canonical/profile actor request, unsigned WebFinger, private-address/credential protections, redirect restrictions, timeout, response bounds and sanitized errors. No name/handle/URL-variant guessing or catalog rewriting.
Ignore delayed signed Accept/Reject for detached history. Preserve existing authentication, routing, setup/security customizations and federated Markdown.
Port/adapt release regressions and guarded operator-only scripts/repair-following-account.sql. The repair SQL is exercised only on synthetic fixtures, not used for actual repair. Update the old pre-027 offline rehearsal helper's expected migration/contract and avoid deletion attempts on restored inactive contacts.
Document source adoption and the separately authorized operational/repair/Rott handoff in docs/follow-contact-adoption.md; retain prior rehearsal evidence as historical, not proof of 031 adoption on existing data.

Verification

npm run typecheck — passed
npm run lint — passed
npm run build — passed; unrelated generated CSS drift excluded
npm test — 737 passed / 69 files, including local-only federation/integration tests
npm run test:ci — 569 passed / 57 files, excludes *.integration.test.ts
npm run test:browser with the documented PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH override to installed Chromium — 40 passed
git diff --check — passed
Signed alias API regression verifies actual request signatures and original account reuse from canonical URL, public profile URL and WebFinger handle; failure tests confirm no unsigned fallback/catalog writes/queued follow.
Migration tests verify fresh setup, upgrade preservation, failure rollback, constraints, idempotence, byte-identical snapshots and sequence allocation; contact/history tests cover all inactive/active states, partial failures, refollow/deduplication, immutable attribution, late signed replies and repair guards.
npm audit reports 29 existing findings (21 moderate, 8 high). Compared against a separate copy of the starting origin/main package/lock files: advisory findings are identical, with no newly vulnerable packages. No unrelated upgrades or audit fix performed.
This site has no toolkit scripts/pre-pr.sh or npm format script; ran the actual site checks above.

Independent read-only review of head 6b145229983bd9fb402d3d6cc74c6d031c61171b found no blockers or non-waived warnings and independently passed 83 tests across seven targeted files, with a clean diff. The report is posted in PR comments; it does not claim verification of existing databases, deployment or Rott.

Remote CI passed for that reviewed head: run #110, CI / build-lint-test (push), successful in 1m30s. Status verified via API (the CLI status command has a known server-relative-URL parsing incompatibility).

Operational boundaries

A local restored-data rehearsal app was found source-watching this checkout and was stopped before editing to prevent automatic startup migration. evc-rehearsal-app-1 remains stopped and must not restart until existing-data migration/startup is separately authorized. Its database was not inspected, migrated, repaired or otherwise modified by this work. The gateway is not an application/worker.

All migration/deletion/repair verification used fresh/disposable synthetic databases; no existing backup/production-data rehearsal was performed or claimed. Hosted revision/schema and the reported Armin/Rott duplicate mapping remain unverified. No CLI update, deployment, release tag/image publication, production inspection/migration, actual duplicate repair, real follow/unfollow, Rott cache changes or display-hiding workaround. Later authorized repair must preserve status/content/history, bind the original profile account/contact, keep independent website feeds separate and verify Rott refresh/association. Development completion does not claim those gated operational stages occurred.

Task: task-c26ddfc5

## Summary Adopts **Safer follow and contact identity** from pinned Slugkit release `47e382cfc1f06060546360aefa36d19e546423a0` (template ZIP **0.12.2**, API package **1.1.0**, compatible management contract **2.3.0**). - Pin `@evcraddock/slug-api` to 1.1.0, update only that dependency in the lockfile, synchronize runtime/site metadata and verify the packaged OpenAPI/contract. - Adapt site-owned contact deletion and migration `031_detached_following_history.sql`: only inactive history can detach, contact-owned accounts are cleaned up transactionally, active follows and unrelated references remain protected. Preserve following/incoming rows, snapshots, generation semantics, aliases, tombstones, cursor positions and sequence high-water marks. Detached history stays internal; explicit future follow can reattach the same following ID without resurrecting removed copies. - Adapt canonical/profile account reuse with reciprocal ActivityPub identity verification, exact contact-owned account matching, canonical metadata, explicit ambiguity errors, race rechecks and atomic persistence. Preserve **site-specific primary-actor signing on every initial/canonical/profile actor request**, unsigned WebFinger, private-address/credential protections, redirect restrictions, timeout, response bounds and sanitized errors. No name/handle/URL-variant guessing or catalog rewriting. - Ignore delayed signed Accept/Reject for detached history. Preserve existing authentication, routing, setup/security customizations and federated Markdown. - Port/adapt release regressions and guarded operator-only `scripts/repair-following-account.sql`. The repair SQL is exercised **only on synthetic fixtures**, not used for actual repair. Update the old pre-027 offline rehearsal helper's expected migration/contract and avoid deletion attempts on restored inactive contacts. - Document source adoption and the separately authorized operational/repair/Rott handoff in `docs/follow-contact-adoption.md`; retain prior rehearsal evidence as historical, not proof of 031 adoption on existing data. ## Verification - `npm run typecheck` — passed - `npm run lint` — passed - `npm run build` — passed; unrelated generated CSS drift excluded - `npm test` — **737 passed / 69 files**, including local-only federation/integration tests - `npm run test:ci` — **569 passed / 57 files**, excludes `*.integration.test.ts` - `npm run test:browser` with the documented `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH` override to installed Chromium — **40 passed** - `git diff --check` — passed - Signed alias API regression verifies actual request signatures and original account reuse from canonical URL, public profile URL and WebFinger handle; failure tests confirm no unsigned fallback/catalog writes/queued follow. - Migration tests verify fresh setup, upgrade preservation, failure rollback, constraints, idempotence, byte-identical snapshots and sequence allocation; contact/history tests cover all inactive/active states, partial failures, refollow/deduplication, immutable attribution, late signed replies and repair guards. - npm audit reports **29 existing findings (21 moderate, 8 high)**. Compared against a separate copy of the starting `origin/main` package/lock files: advisory findings are identical, with no newly vulnerable packages. No unrelated upgrades or `audit fix` performed. - This site has no toolkit `scripts/pre-pr.sh` or npm `format` script; ran the actual site checks above. Independent read-only review of head `6b145229983bd9fb402d3d6cc74c6d031c61171b` found **no blockers or non-waived warnings** and independently passed **83 tests across seven targeted files**, with a clean diff. The report is posted in PR comments; it does not claim verification of existing databases, deployment or Rott. Remote CI **passed** for that reviewed head: [run #110](https://forge.caradoc.com/erik/erikvancraddock.com/actions/runs/110), `CI / build-lint-test (push)`, successful in 1m30s. Status verified via API (the CLI status command has a known server-relative-URL parsing incompatibility). ## Operational boundaries A local restored-data rehearsal app was found source-watching this checkout and was **stopped before editing** to prevent automatic startup migration. `evc-rehearsal-app-1` remains stopped and must not restart until existing-data migration/startup is separately authorized. Its database was **not inspected, migrated, repaired or otherwise modified** by this work. The gateway is not an application/worker. All migration/deletion/repair verification used fresh/disposable **synthetic** databases; no existing backup/production-data rehearsal was performed or claimed. Hosted revision/schema and the reported Armin/Rott duplicate mapping remain unverified. No CLI update, deployment, release tag/image publication, production inspection/migration, actual duplicate repair, real follow/unfollow, Rott cache changes or display-hiding workaround. Later authorized repair must preserve status/content/history, bind the original profile account/contact, keep independent website feeds separate and verify Rott refresh/association. Development completion does not claim those gated operational stages occurred. Task: `task-c26ddfc5`

erik added 1 commit

2026-10-30 21:18:01 -05:00

fix: adopt Slugkit follow and contact identity fixes

CI / build-lint-test (push) Successful in 1m30s

Details

6b14522998

Adapt template 0.12.2 and API 1.1.0 while preserving site signing and retained activity. Include migration 031 and guarded repair handoff; no existing-data migration or deployment.

Task: task-c26ddfc5

erik commented

2026-10-30 21:20:29 -05:00

Author

Owner

Reviewed PR #30 at 6b145229983bd9fb402d3d6cc74c6d031c61171b.

No issues found: no blockers or non-waived warnings.

Read the full diff and relevant surrounding code/tests; compared adoption against pinned Slugkit release 47e382cfc1f06060546360aefa36d19e546423a0 and its stated base.
Contact deletion, migration preservation, verified account reuse, ambiguity/race handling and repair guards appear correct. Site-specific signing and existing customizations are preserved.
Independently ran seven targeted test files: 83 tests passed. git diff --check passed; tracked files remain unchanged.

Verification limits: did not independently rerun the full suite, build or browser checks, or verify remote CI. No existing database, backups, deployment, production mapping or Rott behavior was inspected or modified. Those operational checks remain separately authorized and pending.

Reviewed PR #30 at **`6b145229983bd9fb402d3d6cc74c6d031c61171b`**. **No issues found:** no blockers or non-waived warnings. - Read the full diff and relevant surrounding code/tests; compared adoption against pinned Slugkit release `47e382cfc1f06060546360aefa36d19e546423a0` and its stated base. - Contact deletion, migration preservation, verified account reuse, ambiguity/race handling and repair guards appear correct. Site-specific signing and existing customizations are preserved. - Independently ran seven targeted test files: **83 tests passed**. `git diff --check` passed; tracked files remain unchanged. **Verification limits:** did not independently rerun the full suite, build or browser checks, or verify remote CI. No existing database, backups, deployment, production mapping or Rott behavior was inspected or modified. Those operational checks remain separately authorized and pending.

erik merged commit 2ed211c816 into main

2026-10-30 21:20:34 -05:00

erik deleted branch task-c26ddfc5-follow-contact-fixes

2026-10-30 21:20:34 -05:00

erik referenced this pull request from a commit

2026-10-30 21:20:34 -05:00

Merge pull request 'Adopt Slugkit 0.12.2 follow and contact fixes' (#30) from task-c26ddfc5-follow-contact-fixes into main