root 925cb0d7d6 chore: 2.0.0-alpha.9 — security & correctness hardening (Void 3.0 quick wins) ...

- Q3: prod void DB role NOSUPERUSER (vector marked trusted; deploy/README documents it)
- Q4: buildChildEnv allow-list for the claude subprocess (no OWNER_TOKEN/DATABASE_URL/secrets leak)
- Q5: pending-change approve claims-before-applying + reopens on failure (no re-approvable dup)
- Q6: /capture/upload validates space_id (UUID+existence); pg pool statement_timeout 30s
- Q9: disabled failing syncoid-donatello timer on Z

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-03 07:54:57 +10:00

..

agent_auth.test.js

feat(api): agent bearer auth middleware

2026-05-31 20:59:29 +10:00

agents.test.js

feat(api): agents routes + token mgmt (owner-only)

2026-05-31 21:05:42 +10:00

audit.test.js

feat(api): pending-changes + audit routes

2026-06-01 02:01:10 +10:00

capability_routes.test.js

feat(api): capability enforcement on writes

2026-05-31 21:03:52 +10:00

capture.test.js

chore: 2.0.0-alpha.9 — security & correctness hardening (Void 3.0 quick wins)

2026-06-03 07:54:57 +10:00

companion.test.js

fix(companion): accept view:null in turn schema (rail sends null when no active entity)

2026-06-01 22:49:08 +10:00

conversations.test.js

feat(api): conversations + messages routes

2026-05-31 21:07:36 +10:00

dashboard.test.js

feat(dashboard): owner-only GET/PUT /api/dashboard/layout

2026-06-02 22:19:37 +10:00

errors.test.js

feat(api): error + validate + pagination plumbing

2026-05-31 16:37:06 +10:00

health.test.js

fix(sacred-valley): review polish — render-gen guard, auth-boundary tests, PNG sig, dedup note

2026-06-02 23:20:14 +10:00

helpers.js

feat(api): error + validate + pagination plumbing

2026-05-31 16:37:06 +10:00

host.test.js

feat(host): /api/host CPU/mem/disk/net from /proc

2026-06-02 22:34:04 +10:00

icons.test.js

feat(health): local icon cache /api/icons/:slug.png (no CDN leak)

2026-06-02 22:58:35 +10:00

ingest.test.js

feat(api): karakeep webhook (HMAC-verified)

2026-06-01 03:55:57 +10:00

jobs.test.js

feat(api): jobs routes (list/get/retry/delete, owner-only)

2026-06-01 03:29:52 +10:00

links.test.js

feat(api): links routes

2026-06-01 01:50:50 +10:00

pages.test.js

feat(api): pages routes + revisions + backlinks

2026-05-31 20:48:58 +10:00

pending_changes.test.js

chore: 2.0.0-alpha.9 — security & correctness hardening (Void 3.0 quick wins)

2026-06-03 07:54:57 +10:00

pending_extended_actions.test.js

fix(pending): allow suggest-tier 'upsert' drafts; make dependency wiring owner-only

2026-06-01 23:19:44 +10:00

projects.test.js

feat(api): projects routes

2026-05-31 16:39:31 +10:00

refs.test.js

feat(api): refs routes

2026-05-31 20:50:38 +10:00

resources.test.js

feat(api): resources routes + dependencies + change history

2026-05-31 20:53:10 +10:00

search.test.js

feat(api): unified FTS search

2026-06-01 02:04:57 +10:00

source_docs.test.js

feat(api): source-docs routes

2026-05-31 20:56:00 +10:00

spaces.test.js

feat(api): spaces routes

2026-05-31 16:38:23 +10:00

speedtest.test.js

fix(sacred-valley): review polish — render-gen guard, auth-boundary tests, PNG sig, dedup note

2026-06-02 23:20:14 +10:00

tags.test.js

feat(api): tags routes

2026-06-01 01:46:43 +10:00

tasks.test.js

feat(api): tasks routes

2026-05-31 20:46:39 +10:00

validate.test.js

feat(api): error + validate + pagination plumbing

2026-05-31 16:37:06 +10:00

weather.test.js

feat(weather): /api/weather Open-Meteo proxy with 15-min cache

2026-06-02 22:31:48 +10:00