| Files | Last commit | Last update |
|---|---|---|
feat(catalog): verify signed cloud facts and freeze dispatch prices Add an optional signed catalog layer through the existing config, provider lake, route resolver and dispatch-pricing receipt. Cloud prices are captured at admission and remain stable after refresh, disable and session reload; old turns without a quote cannot borrow later cloud prices. Provider live rosters, exact identities/endpoints, hand tiers and billing modes retain authority. Preserve separate legacy Chat and Anthropic route identities. Bound and authenticate HTTP/disk/cache envelopes, applicability, expiry and rollback history. One ticket gate rejects superseded callbacks and guards publication with atomic cache writes. Reject unsafe file inputs, untrusted future cache hints and provider cache attempts to claim cloud/config price authority. Keep cloud endpoint scope static, independent of operator URL overrides, and retain the existing provider-live wire receipt compatibility. Add fail-closed web transport, strict HEAD/ETag handling, bounded KV reads, fixture validation and guarded authoring. Production trust tables remain empty and cloud facts default off. Public test keys do not activate a feed. Generated website facts remain reserved for combined release integration. Validation on final source: - Rust selected suite: 3396 passed, 0 failed, 9436 skipped (674 config, 17 cloud-facts, 2705 TUI). - Web: 440 passed across 49 files; TypeScript, generated route types, scoped ESLint and cloud-facts fixture/key parity passed. - Production/test cargo check, cargo fmt and diff whitespace checks passed. - Two negative controls: 0 passed, 2 failed as required; digest rejection and late-publication guards restored and hash-verified before final tests. - Earlier executed TUI run: 2509 passed, 2 failed; first combined run: 3394 passed, 1 failed. Fixed status width, explicit MiniMax PAYG fixture authority and the actual legacy identity-parser bug; logs retained. - Required root npm test / check:web both fail: those scripts are absent. Web check:facts reports deferred generated crate/credential-label drift. Local macOS fixture evidence only; Windows checks are source-reviewed. No hosted CI, live provider calls, production key reads, remote database changes, public push, publication or deployment are claimed. Local commit uses an empty per-command hooks path to omit optional session capture; shared hooks configuration is unchanged. Harvested and adapted from PR #5752; donor head 98785c585c3f4f04809438024eac760dda4700fc. Excludes stale synchronization merges and unrelated release history. Exact ownership, hashes, commands and failure logs: /private/tmp/cw-5752-verification-20260907/REPORT.md Co-authored-by: Hmbown <101357273+Hmbown@users.noreply.github.com> | 2 months ago | |
docs(web): stop steering visitors into paused accounts; say what 0.10.2 adds Codewhale accounts, account key storage and the paid product are paused until a frontier security review is available (CURRENT_DECISIONS §38, 2026-10-18). The live site still sent every visitor toward them, and several pages presented 0.10.2 as released. The plan came from a read-only audit of README, site and GitHub copy against the code and CHANGELOG (artifacts/readme-site-20261019/plan.md). Account pause (honesty): - Masthead and mobile menu: "Sign in" removed. - Home and /product: "Create an account" link, the account sentence and the Cloud computers row removed. Hosted web is "In development, not open yet" and points to codewhale web. The desktop row describes what the unreleased app does. - /signin lede and meta: new accounts are not open. /signup redirects to /signin and leaves the sitemap and llms.txt. The signup-counting disclosure copy is updated. - /docs/computers (account-only cloud agents) redirects to Fleet. - Auth docs: "Codewhale accounts", never needed and not open. The account-keys row is gone. - docs/INSTALL.md and zh_hans: "One account for your provider keys" is replaced by "No account needed". docs/CONFIGURATION.md and zh_hans: the account-key section no longer promotes account key storage and keeps only list/remove for existing accounts. Release labels (honesty): - docs/features.toml: chat-color and terminal-dock carry since 0.10.2; the account-login summary is corrected. - /features shows rows newer than the latest published release as source candidates. - /changelog marks a candidate version with the unreleased note and hides compare links to tags that do not exist. - Runtime page "Source version"; FAQ provider count is "the current source declares". - Review and pet docs say what 0.10.1 does and what 0.10.2 adds. Excitement through specifics: - Hero: "The open-source coding agent for any model"; heading "Build and automate from your terminal"; footer tagline to match. - Model facts name the default: deepseek-flash, now DeepSeek-V4.1-Flash. New fact: ChatGPT plan sign-in (experimental). The models page says what changed on 2026-10-17 and titles its table "source v{version}". - New "Coming in v0.10.2" band (lib/content/release-highlights.ts): /pet on, /workbar terminal, /undo, Plan to Work, the curl/wget credential hold and DeepSeek Search. It flips to "New in" at the tag and hides itself when stale. - Community line renders the contributor count from data. - web/MESSAGING.md synced. Every changed dictionary value is translated in all locales; deleted keys are removed everywhere. Generated files come from their generators (prebuild, i18n:gt export). Coded by GPT-6 Astra (codex, workspace-write). Claude added the CONFIGURATION.md sections Astra flagged, regenerated, and ran the gate. Verification: - npm test (repo root): node suites 101/19/413 (7 skipped)/7 passed, 0 failed; Vitest 74 files, 772 tests passed - npm run check:web: production build succeeded - web: check:locales PASS, check:facts OK, check:docs PASS, lint and tsc clean - cargo test -p codewhale-tui --test feature_registry: 2 passed Not done: no visual render check, and no deploy. The live site changes only when a maintainer runs web.yml. Outside this repo, app.codewhale.net/signup still serves "Create account". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NBKbhx19BRbZtvWK8rVKjz | 21 days ago |