Adopt Slugkit 0.12.2 follow and contact fixes #65

Merged

erik merged 2 commits from fix/task-fcb7ffb7-follow-contact into main

2026-10-30 21:15:12 -05:00

erik commented

2026-10-30 21:07:18 -05:00

Owner

Summary

Adopts task task-fcb7ffb7: published Safer follow and contact identity release (template ZIP 0.12.2, @evcraddock/slug-api@1.1.0, compatible/additive contract 2.3.0).

Port reviewed site-owned contact deletion and verified profile/account identity changes, preserving customizations and original generated-template provenance.
Add migration 031: nullable internal account references only for inactive follow history; preserve incoming IDs/snapshots, statuses, timestamps, generations, delivery aliases, tombstones, cursor/sequence positions and FK protections.
Transactionally detach inactive history on explicit contact deletion; protect active follows and unrelated references, hide detached rows from public following/activity routes and ignore delayed Accept/Reject messages.
Reuse exact canonical/profile account matches only after reciprocal canonical identity verification; ambiguity and changed candidates fail without creating duplicate catalog entries.
Add local migration/contact/alias/federation/API/guarded-repair regressions. Repair SQL is operator-only, never startup behavior.
Update this site's exact-version routes/tests/docs from /api/2.2.0 to /api/2.3.0; historical 1.1.0/2.2.0 contracts remain verified read-only references.
Fix an existing Markdown federation test flake by comparing equivalent fractional publication timestamps as instants.

Verification

./scripts/pre-pr.sh: formatting, typecheck, build and generated CSS consistency pass; 72 files / 766 tests pass, including local-only signed federation/integration coverage.
npm run test:ci: 58 files / 588 tests pass; CI exclusions/policy unchanged.
docker build -t slugkit-com:task-fcb7ffb7 .: pass (local image only, no publishing).
node --import tsx scripts/check-contract-adoption.ts: verifies official 1.1.0, 2.2.0, 2.3.0 artifacts/manifests/digests and historical docs; isolated authenticated local slug doctor conforms to 2.3.0.
All data tests use fresh in-memory/disposable synthetic fixtures. Existing migrations are unchanged.
npm audit: 16 advisories (10 moderate, 6 high) in unchanged dependencies; only API root pin/entry changes. Unrelated remediation is not part of this task.

Authorization boundaries

No deployment, image/release publication, existing-data migration, production inspection/duplicate repair, CLI upgrade or normal operator configuration change. docs/follow-contact-adoption.md records adoption, guarded repair, backup/restore and separate authorization requirements. Production adoption/duplicates are unknown, not inferred from this source change.

Delivery gates

Current-head Forgejo CI and independent review must pass before merge. No preflight handoff is selected by the applicable default contributing instructions.

## Summary Adopts task `task-fcb7ffb7`: published Safer follow and contact identity release (template ZIP 0.12.2, `@evcraddock/slug-api@1.1.0`, compatible/additive contract 2.3.0). - Port reviewed site-owned contact deletion and verified profile/account identity changes, preserving customizations and original generated-template provenance. - Add migration 031: nullable internal account references only for inactive follow history; preserve incoming IDs/snapshots, statuses, timestamps, generations, delivery aliases, tombstones, cursor/sequence positions and FK protections. - Transactionally detach inactive history on explicit contact deletion; protect active follows and unrelated references, hide detached rows from public following/activity routes and ignore delayed Accept/Reject messages. - Reuse exact canonical/profile account matches only after reciprocal canonical identity verification; ambiguity and changed candidates fail without creating duplicate catalog entries. - Add local migration/contact/alias/federation/API/guarded-repair regressions. Repair SQL is operator-only, never startup behavior. - Update this site's exact-version routes/tests/docs from `/api/2.2.0` to `/api/2.3.0`; historical 1.1.0/2.2.0 contracts remain verified read-only references. - Fix an existing Markdown federation test flake by comparing equivalent fractional publication timestamps as instants. ## Verification - `./scripts/pre-pr.sh`: formatting, typecheck, build and generated CSS consistency pass; **72 files / 766 tests pass**, including local-only signed federation/integration coverage. - `npm run test:ci`: **58 files / 588 tests pass**; CI exclusions/policy unchanged. - `docker build -t slugkit-com:task-fcb7ffb7 .`: pass (local image only, no publishing). - `node --import tsx scripts/check-contract-adoption.ts`: verifies official 1.1.0, 2.2.0, 2.3.0 artifacts/manifests/digests and historical docs; isolated authenticated local `slug doctor` conforms to 2.3.0. - All data tests use fresh in-memory/disposable synthetic fixtures. Existing migrations are unchanged. - `npm audit`: 16 advisories (10 moderate, 6 high) in unchanged dependencies; only API root pin/entry changes. Unrelated remediation is not part of this task. ## Authorization boundaries No deployment, image/release publication, existing-data migration, production inspection/duplicate repair, CLI upgrade or normal operator configuration change. `docs/follow-contact-adoption.md` records adoption, guarded repair, backup/restore and separate authorization requirements. Production adoption/duplicates are unknown, not inferred from this source change. ## Delivery gates Current-head Forgejo CI and independent review must pass before merge. No preflight handoff is selected by the applicable default contributing instructions.

erik added 1 commit

2026-10-30 21:07:18 -05:00

fix: adopt safer follow and contact identity

CI / verify (pull_request) Successful in 48s

Details

4609a0f0b2

erik added 1 commit

2026-10-30 21:12:56 -05:00

fix: guard follow responses during concurrent contact deletion

CI / verify (pull_request) Successful in 47s

Details

dff1b4f5c2

erik commented

2026-10-30 21:15:06 -05:00

Author

Owner

Independent review — current head `dff1b4f`

A separate read-only Pi review session assessed the complete diff and surrounding implementation/schema/tests using the pr-review skill.

No actionable findings. Recommend approval. Both initial findings were fixed and reviewed again:

Guard initial reads and final status changes across awaited inbox object lookup. Paused signed Accept/Reject regressions reproduced the error before the fix and pass afterward.
Correct current archive/rollout documentation to /api/2.3.0, with migration 031 and separate authorization gates.

Review scope included FK/transaction/sequence preservation, contact cleanup rollback, detached history, reciprocal identity verification and TOCTOU checks, ambiguity, and operator-only repair guards. Static review did not independently rerun tests, inspect CI, fetch remote artifacts or access existing databases/secrets.

Implementer verification at dff1b4f:

./scripts/pre-pr.sh passes: format/typecheck/build, unchanged generated CSS, 72 files / 766 tests, including local integration/federation coverage.
npm run test:ci: 58 files / 588 tests pass.
Local Docker build passes; no image published.
Published artifact checks and disposable authenticated 2.3.0 slug doctor pass.
Required current-head Forgejo CI / verify (pull_request) succeeded in 47 seconds: run 80, SHA dff1b4f5c2d5ccf7fff896292e57b0c0f99b4aef.

No deployment, existing-data migration, production duplicate repair or CLI update/configuration mutation was performed. Existing dependency advisories remain documented, not introduced or silently fixed by this PR. The alternate Claude reviewer was unavailable due to expired authentication; review above completed successfully in the separate Pi session.

## Independent review — current head dff1b4f A separate read-only Pi review session assessed the complete diff and surrounding implementation/schema/tests using the pr-review skill. **No actionable findings. Recommend approval.** Both initial findings were fixed and reviewed again: - Guard initial reads and final status changes across awaited inbox object lookup. Paused signed Accept/Reject regressions reproduced the error before the fix and pass afterward. - Correct current archive/rollout documentation to `/api/2.3.0`, with migration 031 and separate authorization gates. Review scope included FK/transaction/sequence preservation, contact cleanup rollback, detached history, reciprocal identity verification and TOCTOU checks, ambiguity, and operator-only repair guards. Static review did not independently rerun tests, inspect CI, fetch remote artifacts or access existing databases/secrets. Implementer verification at dff1b4f: - `./scripts/pre-pr.sh` passes: format/typecheck/build, unchanged generated CSS, **72 files / 766 tests**, including local integration/federation coverage. - `npm run test:ci`: **58 files / 588 tests** pass. - Local Docker build passes; no image published. - Published artifact checks and disposable authenticated 2.3.0 `slug doctor` pass. - Required current-head Forgejo **CI / verify (pull_request)** succeeded in **47 seconds**: [run 80](https://forge.caradoc.com/erik/slugkit.com/actions/runs/80/jobs/0), SHA `dff1b4f5c2d5ccf7fff896292e57b0c0f99b4aef`. No deployment, existing-data migration, production duplicate repair or CLI update/configuration mutation was performed. Existing dependency advisories remain documented, not introduced or silently fixed by this PR. The alternate Claude reviewer was unavailable due to expired authentication; review above completed successfully in the separate Pi session.

erik merged commit 1801f3aba0 into main

2026-10-30 21:15:12 -05:00

erik deleted branch fix/task-fcb7ffb7-follow-contact

2026-10-30 21:15:12 -05:00

erik referenced this pull request from a commit

2026-10-30 21:15:13 -05:00

Merge pull request 'Adopt Slugkit 0.12.2 follow and contact fixes' (#65) from fix/task-fcb7ffb7-follow-contact into main