Adopt official Slugkit API contract 1.1.0 #23

Merged

erik merged 1 commit from task-c6b1f7e6-versioned-api into main

2026-10-13 17:00:05 -05:00

erik commented

2026-10-13 16:55:35 -05:00

Owner

Sites previously exposed an unversioned local spec and omitted an exact contract declaration, so Doctor could not verify conformance. Adopt the unmodified packaged slugkit-management-api 1.1.0 document with slug-api 0.2.0/core 0.1.2 and matching metadata while retaining /api/v1 and the configured-origin HTTPS fix.

Implement the four optional search filters required by the official contract using upstream service behavior, including literal Unicode matching and post filtering before pagination. No schema migrations, credential changes, or federation/storage configuration changes. Rollout evidence and remaining production gates are in docs/api-contract-adoption.md.

Validation: build/lint, 535 full tests, 459 CI-mode tests, 40 browser tests, local production-image build/smoke, packaged/static spec equality, official archive SHA-256, dev Doctor (all checks including existing auth), and database preservation comparison passed. CI and independent review must pass before merge. Production adoption, production Doctor and live preservation verification remain behind explicit production approval; no release tag/image has been published.

Todu: task-c6b1f7e6.

Sites previously exposed an unversioned local spec and omitted an exact contract declaration, so Doctor could not verify conformance. Adopt the unmodified packaged `slugkit-management-api` 1.1.0 document with slug-api 0.2.0/core 0.1.2 and matching metadata while retaining `/api/v1` and the configured-origin HTTPS fix. Implement the four optional search filters required by the official contract using upstream service behavior, including literal Unicode matching and post filtering before pagination. No schema migrations, credential changes, or federation/storage configuration changes. Rollout evidence and remaining production gates are in `docs/api-contract-adoption.md`. Validation: build/lint, 535 full tests, 459 CI-mode tests, 40 browser tests, local production-image build/smoke, packaged/static spec equality, official archive SHA-256, dev Doctor (all checks including existing auth), and database preservation comparison passed. CI and independent review must pass before merge. Production adoption, production Doctor and live preservation verification remain behind explicit production approval; no release tag/image has been published. Todu: task-c6b1f7e6.

erik added 1 commit

2026-10-13 16:55:35 -05:00

feat: adopt the official versioned API contract and required search behavior

CI / build-lint-test (push) Successful in 41s

Details

2f7c8592b9

erik commented

2026-10-13 16:57:42 -05:00

Author

Owner

Review update

PR: #23 (open)
Task: task-c6b1f7e6
Reviewed source: 2f7c8592b993e74297f922a60fb056b8d0c709e4, independently against main 1eaeb72676d0ae69f1a73c4ad0b7d89c5e2b71cb.
Result: approved for the implementation/PR review stage only. This is not merge, production release/deployment, or task-closure approval.

Summary and verification

Exact package pins and exported contract metadata adopt slugkit-management-api 1.1.0 without changing /api/v1 or the configured-origin HTTPS discovery behavior. The local OpenAPI definition is replaced by an unmodified package re-export.
Reviewed all changed behavior: authenticated literal Unicode/case-insensitive search, preserved owner/status/type/tag filtering, filtering before post pagination, unchanged response summaries, and regression tests. No migration, credential, media-storage, or federation-identity configuration changes are present.
Independently passed npm run typecheck, npm run lint, and npm run test:ci (459 tests / 47 files). Forgejo CI for the exact reviewed SHA passed (run 81, build-lint-test).
Independently fetched the official archive declaration and artifact: package and archived spec bytes match SHA-256 7ce649806998cee82432e60617685886088416b07a8a9b8df3e0721abcd3b37b. Passing route tests check served-spec equality and metadata identity/version.
Dev Doctor/authentication, database digest preservation, 535 full tests, 40 browser tests, and local image smoke evidence are recorded in docs/api-contract-adoption.md and the PR body; these additional checks were not rerun by this reviewer. No repository files were edited.

Acceptance criteria (staged)

met — Dev publishes matching metadata and authoritative packaged spec: local Doctor evidence plus independently passing metadata/spec tests.
partial / pending approval — Production publishes the same verified contract after normal deployment: rollout is documented, but production adoption has not occurred.
met — Metadata/spec identity and version agree with official archived reference: independently verified package/archive bytes and passing route assertions.
partial / pending approval — Installed Doctor and existing authentication: dev passes per recorded evidence; production baseline authentication is recorded, but post-deployment production contract Doctor remains required.
partial / pending approval — Preservation: no migration delta; recorded dev table comparison preserves content/data/identity except normal key last-use metadata. Live production content/media/actor/key baseline comparison and persistence/backup/rollback readiness remain required.
met (pre-rollout stage) — Normal checks, independent review, API addresses and adoption steps: local checks and exact-SHA CI pass; this review passes; dev and production addresses and rollout gates are documented.

Criteria totals: 6 total, 3 fully met, 3 not fully satisfied (all partial/pending production gates; none not-evident).
Blocking implementation issues: 0.
Non-blocking code warnings: 0.
Final verdict: approved, limited to this reviewed source and pre-rollout stage.
Required next steps: obtain explicit human merge approval; separately validate and obtain production release/deployment approval through the normal pipeline, record production Doctor/preservation evidence, then request the separate closure gate. The human-approved implementation plan does not approve any of these later gates. The task remains in progress; production acceptance is not claimed complete.

### Review update - PR: https://forge.caradoc.com/erik/erikvancraddock.com/pulls/23 (open) - Task: `task-c6b1f7e6` - Reviewed source: `2f7c8592b993e74297f922a60fb056b8d0c709e4`, independently against main `1eaeb72676d0ae69f1a73c4ad0b7d89c5e2b71cb`. - Result: **approved for the implementation/PR review stage only**. This is not merge, production release/deployment, or task-closure approval. #### Summary and verification - Exact package pins and exported contract metadata adopt `slugkit-management-api` 1.1.0 without changing `/api/v1` or the configured-origin HTTPS discovery behavior. The local OpenAPI definition is replaced by an unmodified package re-export. - Reviewed all changed behavior: authenticated literal Unicode/case-insensitive search, preserved owner/status/type/tag filtering, filtering before post pagination, unchanged response summaries, and regression tests. No migration, credential, media-storage, or federation-identity configuration changes are present. - Independently passed `npm run typecheck`, `npm run lint`, and `npm run test:ci` (459 tests / 47 files). Forgejo CI for the exact reviewed SHA passed (run 81, build-lint-test). - Independently fetched the official archive declaration and artifact: package and archived spec bytes match SHA-256 `7ce649806998cee82432e60617685886088416b07a8a9b8df3e0721abcd3b37b`. Passing route tests check served-spec equality and metadata identity/version. - Dev Doctor/authentication, database digest preservation, 535 full tests, 40 browser tests, and local image smoke evidence are recorded in `docs/api-contract-adoption.md` and the PR body; these additional checks were not rerun by this reviewer. No repository files were edited. #### Acceptance criteria (staged) 1. **met** — Dev publishes matching metadata and authoritative packaged spec: local Doctor evidence plus independently passing metadata/spec tests. 2. **partial / pending approval** — Production publishes the same verified contract after normal deployment: rollout is documented, but production adoption has not occurred. 3. **met** — Metadata/spec identity and version agree with official archived reference: independently verified package/archive bytes and passing route assertions. 4. **partial / pending approval** — Installed Doctor and existing authentication: dev passes per recorded evidence; production baseline authentication is recorded, but post-deployment production contract Doctor remains required. 5. **partial / pending approval** — Preservation: no migration delta; recorded dev table comparison preserves content/data/identity except normal key last-use metadata. Live production content/media/actor/key baseline comparison and persistence/backup/rollback readiness remain required. 6. **met (pre-rollout stage)** — Normal checks, independent review, API addresses and adoption steps: local checks and exact-SHA CI pass; this review passes; dev and production addresses and rollout gates are documented. - Criteria totals: 6 total, 3 fully met, 3 not fully satisfied (all partial/pending production gates; none not-evident). - Blocking implementation issues: **0**. - Non-blocking code warnings: **0**. - Final verdict: **approved**, limited to this reviewed source and pre-rollout stage. - Required next steps: obtain explicit human merge approval; separately validate and obtain production release/deployment approval through the normal pipeline, record production Doctor/preservation evidence, then request the separate closure gate. The human-approved implementation plan does not approve any of these later gates. The task remains in progress; production acceptance is not claimed complete.

erik merged commit 22db169a7c into main

2026-10-13 17:00:05 -05:00

erik deleted branch task-c6b1f7e6-versioned-api

2026-10-13 17:00:05 -05:00

erik referenced this pull request from a commit

2026-10-13 17:00:06 -05:00

Merge pull request 'Adopt official Slugkit API contract 1.1.0' (#23) from task-c6b1f7e6-versioned-api into main