WP-25 (1bb9383) and WP-27 (5e36d68) were done but the table still said todo — fixed.
WP-28/WP-30 remain todo. Added Phase 7 (refinements & hardening): WP-31 shared store
helpers, WP-32 stamdata undo, WP-33 dev switchers, WP-34 adres phone + BRP read-only,
WP-35 one Concept per type, WP-36 admin cases page + delete. Only 31→32 is ordered.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CodeQL is GitHub-only — its analyze step uploads SARIF to GitHub's code-scanning
API and assumes a GitHub Security tab; this CI runs on Gitea only, so the job could
never go green (it had been red since it was added). Replace it with Semgrep OSS, a
plain CLI SAST with no account/platform API, which runs fine on Gitea.
- Remove the codeql job (+ its security-events permission) and the schedule trigger
(it existed only for codeql; semgrep runs on push + PR).
- Add a semgrep job: setup-python + `pip install semgrep` +
`semgrep scan --config p/default --config p/csharp --metrics=off`. pip-on-runner
(not container:) mirrors the other jobs' model; anonymous registry, telemetry off.
- Report-only for now (no --error → job stays green): a local dry-run found 27
findings, mostly CI/config policy (unpinned actions, .npmrc), not app-code vulns.
WP-30 tracks triaging them + flipping to --error (a blocking gate).
Verified locally: `semgrep scan` runs clean (exit 0 without --error, 306 rules /
450 files). CI behaviour confirmable only on the Gitea runner — watch the run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capture the deferred CI options from the speed pass (708d4c2) so they aren't lost:
node_modules cache to skip npm ci, smaller CI runner image (act_runner label→image,
needs admin; or repo-only container: for node-only jobs), path-filtered jobs, a fast
split lint job, and an optional lean prod backend image. Notes the constraints (CI not
observable from the agent env; compose images aren't used by CI). Added the README row.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`npm run format:check` (a CI gate) had drifted red across 44 files — pre-existing
files plus recently-added ones committed without formatting. Ran `prettier --write .`;
no logic changes. Also regenerates documentation.json (compodoc reflects the reformatted
component sources).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Amend ADR-0004 to record what shipped in 0e77faf: a table may live as typed
C# or as a typed JSON data-file (the compile-time value check traded for
editor ergonomics, caught by StamdataValidationTests instead); valid-time and
the generic StamdataCatalog/StamdataTable model; the low-code PR-emitting
editor is no longer "future". Add WP-29 backlog file (done) + README row.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Move working docs (backlog, prd, roadmap) under docs/project/ and durable
docs (architecture ADRs, guides, audits) under docs/reference/; add a
docs/README.md index. Update every path reference in code comments, CLAUDE.md,
READMEs, and the new-ssp skill. Expand the Storybook Foundations curriculum
(Overview, BDD, i18n; rename Layers→Domain-Driven Design) and reorder the sidebar.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
One behavior per test across FE machine/store specs and backend endpoint
tests, so a failure names exactly what broke.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ehoandClaude Opus 4.8