Adopt incoming activity and API contract 2.2.0 #63

Merged

erik merged 2 commits from feat/task-0504063b-incoming-activity into main

2026-10-27 16:40:04 -05:00

erik commented

2026-10-27 16:27:47 -05:00

Owner

Summary

Adopt the October 27 incoming-activity release for this customized Slugkit reference site (task-0504063b).

Pin slug-api 1.0.0 / contract 2.2.0 and slug-federation 0.1.1; retain auth 1.0.0 and original template provenance.
Adapt following to accountId with safe legacy mapping and referenced-account/contact protections.
Add site-owned post/boost inbox handlers, persistent buffer service, authenticated GET/DELETE routes and exact reviewed migrations 027–030.
Move the operational base to /api/2.2.0; preserve exact official 1.1.0 and 2.2.0 references, historical reference-only docs, digest verification and discovery. No archive code changes or republishing are needed.
Preserve site branding/rendering, auth/security, signing identity and existing replies/engagement. Document backup/restore, client compatibility and separately authorized rollout/rollback.

Verification

./scripts/pre-pr.sh: formatting, typecheck, build, generated CSS consistency, 692 tests across 67 files passed (including local-only signed federation and HTTP integration tests).
npm run test:ci: 557 tests across 55 files passed; integration tests remain excluded from CI.
node --import tsx scripts/check-contract-adoption.ts: real official 1.1.0/2.2.0 schemas/manifests/digests and docs verified; authenticated loopback slug doctor passes all checks against 2.2.0 using an in-memory database and disposable CLI config.
Synthetic SQLite backup/restore test migrates only the restored fixture through 027–030, leaving the legacy fixture and backup unchanged. Coverage includes duplicate-account ambiguity/rollback, 030 snapshot/tombstone/alias/cursor/sequence preservation and idempotence.
Production configuration and existing databases were not opened or modified.

Authorization boundary

No release tag, image publication, production migration/deployment or normal operator CLI configuration change. Do not start the new app/watchers against existing data without migration authorization. See docs/incoming-activity-adoption.md for backup/restore rehearsal, actual proxy/client DELETE-JSON checks and rollback requirements. Production adoption remains a separately authorized operator step.

Independent review found two listener-level deadline/generation gaps in the upstream integration pattern. The follow-up starts incoming processing before legacy reply/engagement lookups and joins both independent handler outcomes before queue completion. Five registered-listener regressions cover document/context timeouts, Create/Announce rapid refollow, and reply moderation despite an incoming timeout. The original ordering was temporarily restored to confirm the four deadline/generation regressions fail, then the fix was restored and all 692 tests passed. Updated independent review and current-head Forgejo CI are required before merge.

## Summary Adopt the October 27 incoming-activity release for this customized Slugkit reference site (task-0504063b). - Pin slug-api 1.0.0 / contract 2.2.0 and slug-federation 0.1.1; retain auth 1.0.0 and original template provenance. - Adapt following to accountId with safe legacy mapping and referenced-account/contact protections. - Add site-owned post/boost inbox handlers, persistent buffer service, authenticated GET/DELETE routes and exact reviewed migrations 027–030. - Move the operational base to `/api/2.2.0`; preserve exact official 1.1.0 and 2.2.0 references, historical reference-only docs, digest verification and discovery. No archive code changes or republishing are needed. - Preserve site branding/rendering, auth/security, signing identity and existing replies/engagement. Document backup/restore, client compatibility and separately authorized rollout/rollback. ## Verification - `./scripts/pre-pr.sh`: formatting, typecheck, build, generated CSS consistency, **692 tests across 67 files passed** (including local-only signed federation and HTTP integration tests). - `npm run test:ci`: **557 tests across 55 files passed**; integration tests remain excluded from CI. - `node --import tsx scripts/check-contract-adoption.ts`: real official 1.1.0/2.2.0 schemas/manifests/digests and docs verified; authenticated loopback `slug doctor` passes all checks against 2.2.0 using an in-memory database and disposable CLI config. - Synthetic SQLite backup/restore test migrates only the restored fixture through 027–030, leaving the legacy fixture and backup unchanged. Coverage includes duplicate-account ambiguity/rollback, 030 snapshot/tombstone/alias/cursor/sequence preservation and idempotence. - Production configuration and existing databases were not opened or modified. ## Authorization boundary **No release tag, image publication, production migration/deployment or normal operator CLI configuration change.** Do not start the new app/watchers against existing data without migration authorization. See `docs/incoming-activity-adoption.md` for backup/restore rehearsal, actual proxy/client DELETE-JSON checks and rollback requirements. Production adoption remains a separately authorized operator step. Independent review found two listener-level deadline/generation gaps in the upstream integration pattern. The follow-up starts incoming processing before legacy reply/engagement lookups and joins both independent handler outcomes before queue completion. Five registered-listener regressions cover document/context timeouts, Create/Announce rapid refollow, and reply moderation despite an incoming timeout. The original ordering was temporarily restored to confirm the four deadline/generation regressions fail, then the fix was restored and all 692 tests passed. Updated independent review and current-head Forgejo CI are required before merge.

erik added 1 commit

2026-10-27 16:27:47 -05:00

feat: adopt incoming activity and contract 2.2.0

CI / verify (pull_request) Successful in 52s

Details

adc0124682

Task: task-0504063b. Preserve customized site and historical official references; keep production migration/deployment separately gated.

erik added 1 commit

2026-10-27 16:37:54 -05:00

fix: capture incoming scope before legacy inbox resolution

CI / verify (pull_request) Successful in 44s

Details

b0d126ba7a

Address independent review findings on listener deadlines and rapid refollow races. Start incoming first and observe both handler outcomes; add five actual-listener regressions.

erik commented

2026-10-27 16:40:04 -05:00

Author

Owner

Independent re-review of b0d126ba7a: no actionable issues found. Both original P2 findings are resolved; incoming scope/deadlines begin before legacy resolution, and both independent handler outcomes are observed before queue completion/retry. Review artifact: /tmp/slugkit-task-0504063b-rereview-pi.txt (read-only source review; reviewer did not rerun tests).

Verification by implementing agent: ./scripts/pre-pr.sh passed formatting/typecheck/build/CSS consistency and 692 tests/67 files; deterministic test:ci passed 557/55. Five registered-listener regressions passed three additional repeated runs. Real official 1.1.0/2.2.0 references and authenticated local slug doctor passed. Forgejo Actions run #73 reports success for current head b0d126ba7a (44s), observed via fj actions tasks; fj pr status has a response-parsing bug.

No outstanding review findings. No production data migration, release/image publication, deployment or normal operator CLI configuration change. Operator rollout prerequisites are in docs/incoming-activity-adoption.md.

Independent re-review of b0d126ba7ade554a6cccd0d35222946685123ccf: no actionable issues found. Both original P2 findings are resolved; incoming scope/deadlines begin before legacy resolution, and both independent handler outcomes are observed before queue completion/retry. Review artifact: /tmp/slugkit-task-0504063b-rereview-pi.txt (read-only source review; reviewer did not rerun tests). Verification by implementing agent: ./scripts/pre-pr.sh passed formatting/typecheck/build/CSS consistency and 692 tests/67 files; deterministic test:ci passed 557/55. Five registered-listener regressions passed three additional repeated runs. Real official 1.1.0/2.2.0 references and authenticated local slug doctor passed. Forgejo Actions run #73 reports success for current head b0d126ba7a (44s), observed via fj actions tasks; fj pr status has a response-parsing bug. No outstanding review findings. No production data migration, release/image publication, deployment or normal operator CLI configuration change. Operator rollout prerequisites are in docs/incoming-activity-adoption.md.

erik merged commit 1ac8d82efe into main

2026-10-27 16:40:04 -05:00

erik deleted branch feat/task-0504063b-incoming-activity

2026-10-27 16:40:04 -05:00

erik referenced this pull request from a commit

2026-10-27 16:40:06 -05:00

Merge pull request 'Adopt incoming activity and API contract 2.2.0' (#63) from feat/task-0504063b-incoming-activity into main