Repository navigation
Blog pipeline: source of truth matches the current app (2.03.5) - #10
Merged
Merged
Conversation
SOURCE-OF-TRUTH.md described the old app: Supabase, email + password with OTP, a 20-note allowance, last-write-wins sync and a rolling energy window. It now lists what 2.03.5 ships: - Google Drive sync (drive.file), a metadata-only server, replay-safe sync and conflict copies. - The vault parameters, Google sign-in, fixed-time daily energy and the 30/40/50/100 note tiers. - Measured timings, and what is planned. STYLE-RULES, the research prompt, the author bio and the engineering category no longer mention Supabase. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
CI's "npm audit --audit-level=high" failed on every branch after GitHub published GHSA-vfj7-8cjw-p6xm (braces <= 3.0.3, no patched release). braces only came in through tailwindcss 3 (chokidar, micromatch, fast-glob). Tailwind 4 doesn't use it, so the high-severity audit stays strict and now reports 0 vulnerabilities. - tailwindcss 4.3.3 + @tailwindcss/postcss. autoprefixer is gone (v4 does prefixing itself). - globals.css: @import "tailwindcss" and @config for the existing JS theme. - Controller inputs: outline-none is outline-hidden in v4 (same look). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A cookie signed a moment ago could be rejected as "from the future" when the verifying process or instance read a clock a few milliseconds behind the signing one (age < 0). The smoke test failed this way about one run in five on Windows, and Vercel instances can hit the same edge right after sign-in. Timestamps are HMAC-signed, so allowing 60 s of skew lets nobody forge anything. A 5-minute future cookie is still rejected, and the test now also checks that 2 s of skew is accepted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The blog pipeline's
SOURCE-OF-TRUTH.mdstill described the old app: Supabase, email and password login with OTP, a 20-note allowance, last-write-wins sync and a rolling energy window. Any blog generated from it would repeat those mistakes.It now lists what 2.03.5 actually ships:
drive.file), a server that stores metadata only, replay-safe sync and conflict copies.STYLE-RULES, the research prompt, the author bio and the engineering category description no longer mention Supabase. The author bio and category text appear on the website's blog.
Build OK, smoke tests 22/22.
🤖 Generated with Claude Code