erik/slugkit.com
1
0
Fork 0
Code Issues 9 Pull requests Projects Releases Packages Wiki Activity Actions

Serve official contracts at exact-version API addresses #54

Merged
erik merged 1 commit from feat/task-c934d36b-contract-archive into main 2026-10-13 15:03:18 -05:00
Conversation 2 Commits 1 Files changed 32 +697 -283
erik commented 2026-10-13 14:55:39 -05:00
Owner
Copy link

Slugkit.com's public documentation currently uses a major-version route and cannot retain official reference specifications by exact contract release. Move this site's live management API and metadata to /api/1.1.0, remove /api/v1 without an alias as explicitly requested, and update its documentation link. Serve exact packaged artifact bytes and provide a true contract-version selector, with historical references verified against a durable archive independent of website upgrades.

Public archive reads use only the fixed official Forgejo source, omit caller credentials and reject redirects. Unknown versions return 404; failed storage or verification returns 503. Current installed specification access survives an archive outage. Interactive documentation uses the actual current live address while archived documents retain their original bytes; historical interactive requests are disabled. Existing management operations, storage, credentials and federation identity remain unchanged. Other generated sites and their API routes are unaffected.

Validation: complete local pre-PR checks passed (356 tests), including existing API operations at the new base, old-route removal, artifact byte equality, two-version retention through website recreation, credential isolation, failure behavior and documentation selection. A local browser verified the rendered selector and live server address. Initial archive publication is coordinated with the API repository PR; deployment and updating only this computer's Slugkit.com CLI base URL will happen after explicit merge approval. No database migration is needed.

Task: task-c934d36b. Rollout/rollback and forward-only historical policy: docs/api-contract-archive.md. Production currently remains on the prior deployed image until integration is approved.

Slugkit.com's public documentation currently uses a major-version route and cannot retain official reference specifications by exact contract release. Move this site's live management API and metadata to `/api/1.1.0`, remove `/api/v1` without an alias as explicitly requested, and update its documentation link. Serve exact packaged artifact bytes and provide a true contract-version selector, with historical references verified against a durable archive independent of website upgrades. Public archive reads use only the fixed official Forgejo source, omit caller credentials and reject redirects. Unknown versions return 404; failed storage or verification returns 503. Current installed specification access survives an archive outage. Interactive documentation uses the actual current live address while archived documents retain their original bytes; historical interactive requests are disabled. Existing management operations, storage, credentials and federation identity remain unchanged. Other generated sites and their API routes are unaffected. Validation: complete local pre-PR checks passed (356 tests), including existing API operations at the new base, old-route removal, artifact byte equality, two-version retention through website recreation, credential isolation, failure behavior and documentation selection. A local browser verified the rendered selector and live server address. Initial archive publication is coordinated with the API repository PR; deployment and updating only this computer's Slugkit.com CLI base URL will happen after explicit merge approval. No database migration is needed. Task: task-c934d36b. Rollout/rollback and forward-only historical policy: `docs/api-contract-archive.md`. Production currently remains on the prior deployed image until integration is approved.
feat: serve official contracts at exact-version API addresses
All checks were successful
CI / verify (pull_request) Successful in 41s
Details
ffc3b0372c 
Task: #task-c934d36b
erik commented 2026-10-13 14:59:18 -05:00
Author
Owner
Copy link

Independent review

  • Task: task-c934d36b. Coordinated PRs remain open.
  • Website PR Serve official contracts at exact-version API addresses, head ffc3b0372c443c8619fd68fb0afd7f3c678f7700: approved, no actionable findings or warnings.
  • Publication PR Publish immutable API contract artifacts from releases, head 715307233414dd64c4ea1ed2b4d4a437853dd9db: changes requested. Explicitly wire the existing short-lived Actions token into both the dedicated archive publication step and the normal API release archive step, consistent with existing repository release workflows.
  • Acceptance criteria: genuine public artifact/digest partial pending publication/deployment; exact-version documentation link partial pending deployment; two-version retention met in deterministic fixtures with production evidence pending; immutable rejection/retry met in deterministic tests with workflow correction required; documented discovery/failure policy met; public credential isolation and relocated management operations locally verified with deployment pending; local CLI update partial and intentionally deferred until deployment.
  • Local checks and current-head CI passed for both reviewed commits. Independent reviewer did not rerun broad checks. No merge, archive publication, production deployment or local global CLI configuration change has occurred.
  • Blocking findings: one in publication; none in website. Warnings: none. Next: fix credential wiring, rerun required verification/current-head CI, and obtain updated independent publication review before the human merge gate.
### Independent review - Task: task-c934d36b. Coordinated PRs remain open. - Website PR [Serve official contracts at exact-version API addresses](https://forge.caradoc.com/erik/slugkit.com/pulls/54), head `ffc3b0372c443c8619fd68fb0afd7f3c678f7700`: approved, no actionable findings or warnings. - Publication PR [Publish immutable API contract artifacts from releases](https://forge.caradoc.com/erik/slugkit/pulls/300), head `715307233414dd64c4ea1ed2b4d4a437853dd9db`: changes requested. Explicitly wire the existing short-lived Actions token into both the dedicated archive publication step and the normal API release archive step, consistent with existing repository release workflows. - Acceptance criteria: genuine public artifact/digest partial pending publication/deployment; exact-version documentation link partial pending deployment; two-version retention met in deterministic fixtures with production evidence pending; immutable rejection/retry met in deterministic tests with workflow correction required; documented discovery/failure policy met; public credential isolation and relocated management operations locally verified with deployment pending; local CLI update partial and intentionally deferred until deployment. - Local checks and current-head CI passed for both reviewed commits. Independent reviewer did not rerun broad checks. No merge, archive publication, production deployment or local global CLI configuration change has occurred. - Blocking findings: one in publication; none in website. Warnings: none. Next: fix credential wiring, rerun required verification/current-head CI, and obtain updated independent publication review before the human merge gate.
erik commented 2026-10-13 15:02:25 -05:00
Author
Owner
Copy link

Coordinated independent review approved

  • API publication PR Publish immutable API contract artifacts from releases, exact head ff2bb09d83c11508448521793a8ba05236f50613: approved. The sole prior finding is resolved by explicitly supplying the existing short-lived Actions token to both publication steps. Current-head CI run 518 passed, and full local pre-PR verification passed again (1,236 tests).
  • Website PR Serve official contracts at exact-version API addresses, exact head ffc3b0372c443c8619fd68fb0afd7f3c678f7700: approved. Current-head CI run 47 and complete local verification (356 tests) passed. The independent reviewer confirmed the unchanged approved head.
  • Blocking issues: none. Warnings: none. Both PRs are open. Required review comments are posted on both PRs and this task. Review is approved; merge approval is waiting for the human.
  • Acceptance criterion 1 partial: the genuinely released package artifact was validated, and exact public artifact serving is locally verified; initial archive publication/deployment remain pending.
  • Acceptance criterion 2 partial: exact-version documentation link and rendering are verified locally; deployment remains pending.
  • Acceptance criterion 3 met in deterministic tests: an earlier document remains independently accessible after subsequent publication and website recreation; fixtures are explicitly distinguished from genuine releases. Initial production will contain only contract 1.1.0 until another genuine release exists.
  • Acceptance criterion 4 met in deterministic tests: changed specifications are rejected, identical retries succeed, and subsequent packages sharing the contract preserve first-publication provenance. Normal Actions execution remains pending integration.
  • Acceptance criterion 5 met: public discovery, unsupported/unknown versions, unavailable storage and publication failures are explicitly documented.
  • Acceptance criterion 6 partial: caller credentials are not forwarded, existing operations pass at the new base and /api/v1 is unavailable locally; live preservation verification remains pending deployment.
  • Acceptance criterion 7 partial: the local global CLI configuration remains intentionally untouched until the new production route is deployed; only its Slugkit.com base address will change, with credentials and all other sites preserved.
  • Next after explicit human merge approval: merge both changes; run the normal archive publication workflow for API package 0.2.0; release and deploy the website through normal Actions and GitOps; update the authorized local CLI entry; verify all deployed criteria, restore image automation as appropriate, and run the close gate only with human authorization. No manual publication workaround, historical artifact fabrication or credential rotation is planned.
### Coordinated independent review approved - API publication PR [Publish immutable API contract artifacts from releases](https://forge.caradoc.com/erik/slugkit/pulls/300), exact head `ff2bb09d83c11508448521793a8ba05236f50613`: approved. The sole prior finding is resolved by explicitly supplying the existing short-lived Actions token to both publication steps. Current-head CI run 518 passed, and full local pre-PR verification passed again (1,236 tests). - Website PR [Serve official contracts at exact-version API addresses](https://forge.caradoc.com/erik/slugkit.com/pulls/54), exact head `ffc3b0372c443c8619fd68fb0afd7f3c678f7700`: approved. Current-head CI run 47 and complete local verification (356 tests) passed. The independent reviewer confirmed the unchanged approved head. - Blocking issues: none. Warnings: none. Both PRs are open. Required review comments are posted on both PRs and this task. Review is approved; merge approval is waiting for the human. - Acceptance criterion 1 partial: the genuinely released package artifact was validated, and exact public artifact serving is locally verified; initial archive publication/deployment remain pending. - Acceptance criterion 2 partial: exact-version documentation link and rendering are verified locally; deployment remains pending. - Acceptance criterion 3 met in deterministic tests: an earlier document remains independently accessible after subsequent publication and website recreation; fixtures are explicitly distinguished from genuine releases. Initial production will contain only contract 1.1.0 until another genuine release exists. - Acceptance criterion 4 met in deterministic tests: changed specifications are rejected, identical retries succeed, and subsequent packages sharing the contract preserve first-publication provenance. Normal Actions execution remains pending integration. - Acceptance criterion 5 met: public discovery, unsupported/unknown versions, unavailable storage and publication failures are explicitly documented. - Acceptance criterion 6 partial: caller credentials are not forwarded, existing operations pass at the new base and `/api/v1` is unavailable locally; live preservation verification remains pending deployment. - Acceptance criterion 7 partial: the local global CLI configuration remains intentionally untouched until the new production route is deployed; only its Slugkit.com base address will change, with credentials and all other sites preserved. - Next after explicit human merge approval: merge both changes; run the normal archive publication workflow for API package 0.2.0; release and deploy the website through normal Actions and GitOps; update the authorized local CLI entry; verify all deployed criteria, restore image automation as appropriate, and run the close gate only with human authorization. No manual publication workaround, historical artifact fabrication or credential rotation is planned.
erik merged commit ef53d54d3b into main 2026-10-13 15:03:18 -05:00
erik deleted branch feat/task-c934d36b-contract-archive 2026-10-13 15:03:18 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
activitypub

   
actor

   
admin

   
ai-safety

   
article

   
articles

   
atproto

   
bug

   
cli

   
configuration

   
content

   
dev-environment

   
docker

   
enhancement

   
feature

   
federation

   
fediverse

   
forgejo

   
garage

   
health

   
how-to

   
logging

   
markdown

   
mastodon

   
media

   
navigation

   
opengraph

   
passkeys

   
preview

   
priority:medium

   
production

   
release

   
rendering

   
s3

   
settings

   
setup

   
status:active

   
status:done

   
status:inprogress

   
technical

   
webauthn
No labels
activitypub
actor
admin
ai-safety
article
articles
atproto
bug
cli
configuration
content
dev-environment
docker
enhancement
feature
federation
fediverse
forgejo
garage
health
how-to
logging
markdown
mastodon
media
navigation
opengraph
passkeys
preview
priority:medium
production
release
rendering
s3
settings
setup
status:active
status:done
status:inprogress
technical
webauthn
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
erik/slugkit.com!54
No description provided.