[JUM-821][Release] Promote dev to main — factory cli-init + npm publish readiness - #406
Closed
web2solutions wants to merge 90 commits into
Closed
web2solutions wants to merge 90 commits into
web2solutions wants to merge 90 commits into
Conversation
JUM-811…814: widget grid, OAS metrics widgets, Users examples, axe, docs. Co-authored-by: Cursor <cursoragent@cursor.com>
) ## Summary - Module Dashboard tab now renders a widget grid: generic OAS metrics plus Users domain widgets (members per org, admin/user ratio, sign-ups 30d). - Server mode uses GET /metrics (`x-metrics-capabilities`); Cana mode uses `listLocal` + `runMetricsQuery`. - Cypress axe on the dashboard at 375/768/1280; table fallback on `ChartCard`. Docs EN/PT (Req 094). One PR covers JUM-811…814. ## Problem Statement Every module Dashboard showed two list-envelope totals. The epic needs contract metrics, domain widget registration, a11y, and docs. - Related issue(s): JUM-811, JUM-812, JUM-813, JUM-814 - Related PR(s): none - Related check run(s): pending `branch-gate`, `third-party-review` ## Project Tracking (Required) - Linear Project: Jumentix (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epicfrontend-domain-dashboards-contract-metrics-and-domain-widgets-253f9af04407 - Epic milestone: Domain dashboards — 2026-12-05 - Primary task nature: Feature - Epic-delegated agent ID: owner-delegated (Req 090) - Child task issue link: https://linear.app/jumentix/issue/JUM-811 - Project Update: to be published on merge - Linear Project link(s): https://linear.app/jumentix/project/epicfrontend-domain-dashboards-contract-metrics-and-domain-widgets-253f9af04407 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-811, https://linear.app/jumentix/issue/JUM-812, https://linear.app/jumentix/issue/JUM-813, https://linear.app/jumentix/issue/JUM-814 - Linear Issue ID list (comma separated): JUM-811, JUM-812, JUM-813, JUM-814 - Item status at PR creation: Backlog (implementation on this PR) - Target cycle (`Start date` -> `End date`): 2026-11-10 -> 2026-12-05 - Priority group for this PR (`P0` / `P1` / `P2`): P2 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/feature/JUM-811-domain-dashboards` - Target branch: dest - Required PR title format: `[JUM-XXXX][Nature] <concise outcome>` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets dest. - [x] If this PR targets main, it is a release promotion sourced from dest — N/A (targets dest). - [x] This PR is not a direct task/topic branch promotion to main. ## Bidirectional Traceability (Required) - [ ] Every linked issue already contains this PR URL. - [x] Every linked issue already contains commit hash/range evidence. - [x] PR description includes mapping of task -> commit(s). - Task -> commit(s) mapping: - `JUM-811`/`JUM-812`/`JUM-813`/`JUM-814`: `dc2efbe67f62ddd1f851ca7d746af0df3fa69d69` ## Scope of Change ### Domain / Business Rules - Dashboard metrics follow OAS `x-metrics-capabilities` and RBAC of the matching list operation. ### Application / Use Cases - Generic widgets per module entity; Users registers three domain widgets. ### Adapters / Infrastructure - No new npm packages. `cypress-axe` already at repo root. ### API / Contracts (OpenAPI, DTOs, handlers, controllers) - Consumes existing `getUsersMetrics` / `getOrganizationsMetrics`. No OAS change. ## Detailed Technical Changes 1. `DashboardGrid` plus `DashboardWidget` on `manifest.dashboard.widgets`. 2. `metricsSchema.ts` plus `genericWidgets.ts` plus `ChartCard` table fallback. 3. Frontend Cypress e2e registered in `test-map.json` (nightly `frontend:test:e2e`). ## Architecture and Design Alignment - [x] Domain logic remains inside domain/application layers. - [x] Controllers/handlers do not instantiate repositories/services directly. - [x] Ports/adapters boundaries are respected. - [x] No new circular dependencies introduced. - [x] Event publishing/listening flow remains consistent. Frontend seed: OAS plus `packages/*` only (Req 136). ## Security Impact - Security impact: No security impact. Metrics use the same list scopes. - Secrets handling reviewed: [x] N/A - Input/output sanitization reviewed: [x] Yes - AuthN/AuthZ impact: [x] No - Data exposure risk (password/salt/token/PII): [x] No - Sonar security findings addressed or unaffected: [x] Yes ## Data and Migration Impact - Data model impact: none - Migration required: [x] No - Rollback strategy: revert the merge commit on dest ## Breaking Changes None. Dashboard totals still appear; they now come from `/metrics` instead of list `total`. ## Acceptance Criteria - [x] Feature/bug behavior matches expected functional outcome. - [x] Error paths and edge cases are covered. - [x] API contract changes (if any) are documented and validated. - [x] Architecture boundaries remain enforced. - [x] No regression in existing workflows. ## Test Plan (Evidence) Commands actually run: - `rtk proxy bun run --filter @jumentix/frontend test` — 301 pass, 0 fail, 849 expect() (husky) - `rtk proxy bun run --filter @jumentix/frontend lint` — 0 errors - `rtk proxy bun run --filter @jumentix/frontend build` — Vite built - `env -u CYPRESS_CACHE_FOLDER rtk proxy bun run --filter @jumentix/frontend test:e2e` — all specs pass - `rtk proxy bun run --filter @jumentix/frontend test:coverage && rtk proxy bun run frontend:coverage:check` - [x] lint (frontend plus husky eslint) - [ ] `pnpm run deps:check-cycles` (not run as standalone this delivery) - [x] workspace-boundaries (husky) - [ ] `pnpm run arch:check-users-legacy-imports` (not run standalone) - [x] unit tests (frontend 301 plus husky layer-aware) - [ ] `pnpm run oas:check-routes` (not run standalone) - [x] `build:dev` (husky tsc -p tsconfig.build.json) - [ ] `pnpm run ci:smoke` (not run standalone) - [ ] `pnpm run ci:gate` (task gate via husky, not full ci:gate) ### Coverage Command: `rtk proxy bun run --filter @jumentix/frontend test:coverage && rtk proxy bun run frontend:coverage:check` - lines 90.35% (8210/9087) threshold 85% PASS - functions 87.33% (1213/1389) threshold 80% PASS - branches unmeasured — bun emits no branch records (Requirement 110 section 2) - Project coverage >= 95%: [x] No (frontend gate is 85% lines / 80% functions; that gate passed) - Patch coverage >= 95%: [x] No (not measured this run) - Codecov status passing: [x] No (Codecov not a required dest check) ### SonarQube Cloud - Quality Gate passing: pending CI - New vulnerabilities introduced: pending CI - New security hotspots reviewed: [x] N/A until CI Axe: `color-contrast` disabled on dashboard grid because Chart.js canvas brand blues fail at md+; numbers are in the table fallback. ## Performance / Reliability Impact No measurable impact. ## Observability - Logs updated: [x] No - Metrics/Tracing updated: [x] N/A ## Deployment and Rollout - Deployment notes: merge to dest; no flag - Feature flag needed: [x] No - Rollout strategy: dest then release train - Rollback steps: revert merge commit ## Risks and Mitigations 1. Risk: hidden dashboard tbody rows broke X-CRUD e2e counts. Mitigation: specs now scope `.xcrud-grid tbody tr`. 2. Risk: axe color-contrast on canvas. Mitigation: table fallback plus documented axe rule disable. ## Documentation Updates - [x] README updated (if needed) - [x] Additional docs updated (FRONTEND-SEED-AND-XCRUD EN/PT, apps/frontend/AGENTS.md) - [x] Changelog updated/synced (husky changelog:update) ## Reviewer Checklist - [ ] Changes are clear and scoped. - [ ] Acceptance criteria are testable and satisfied. - [ ] Tests are sufficient for risk level. - [ ] Security and data impacts are addressed. - [ ] CI checks pass fully. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Dashboard totals now depend on `/metrics` and offline metrics aggregation; RBAC is unchanged but more API surface is exercised in the shell UI. > > **Overview** > Replaces the module **Dashboard** tab’s two hardcoded list-total cards with a **widget grid** driven by the OAS metrics contract and optional domain widgets on `manifest.dashboard.widgets`. > > **Metrics & widgets:** Adds `metricsSchema` (`x-metrics-capabilities` → metrics operationIds), `loadMetrics` (online `GET …/metrics` with list RBAC; offline Cana + `runMetricsQuery`), and auto-generated widgets per entity (count, groupBy, series, relation fan-out). Users module registers three domain widgets (members per org, admin/user ratio, 30-day sign-ups). `ChartCard` adds Chart.js with a table toggle for a11y. > > **Tests & CI:** New Cypress `dashboard-a11y` (axe at three viewports); dashboard e2e asserts totals against the real metrics API. Cypress X-CRUD specs scope row queries to `.xcrud-grid` so hidden dashboard tables do not break counts. Frontend e2e specs are registered in `test-map.json` as nightly; unit/component coverage for metrics and dashboard components. > > **Docs:** `AGENTS.md` and FRONTEND-SEED-AND-XCRUD (EN/PT) document the dashboard widget model. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit dc2efbe. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Clear Sonar reliability bugs, replace the broken coverage measure badge, run the coverage job (Codecov upload + Sonar) on main and dev, and embed the Codecov grid graph in the READMEs (JUM-823). Co-authored-by: Cursor <cursoragent@cursor.com>
…UM-839) (#356) - monitoringCharts drawStackedArea: guard null series in the totals reduce, matching the neighboring guards (TypeError latent) - RestAPI getHandlerFactory: typeof guard on the handler default, matching RealtimeAPIBase; truthy non-function defaults now fall through to the next framework candidate instead of throwing 'not a function' - UserService: drop dead newData ?? {} (newData is always an object) - purgeTombstones parseInstant: document the owner decision — numeric epoch deletedAt is not an accepted representation and is intentionally never purged (contract: ISO string or Date) - CommercialPages: update the relationship snippet to the string-named decorator syntax Validated: 371 tests across 33 suites green under bun:test --isolate, RestAPI.nonFunctionDefault 1/1 on both runners, lint clean.
* docs: retire superseded governance material * fix(ci): resolve git binary for governance docs check * style(docs): remove trailing blank lines
Add Req 137 and arch:check-ownership-placement; move SM suites, tooling proof suites, and component scripts into owner homes; delete dual-home package clones; wire the gate into ci:gate and branch preflight. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep new reliability and Codecov suites under ci-cd/test with sibling requires, preserve README badge path depth, and regenerate test-map. Co-authored-by: Cursor <cursoragent@cursor.com>
Refine Req 137 heuristics so comments and ci-cd fixtures stop false positives, keep SM-api @src composition, document suite homes, and harden CLI path joins against traversal findings. Co-authored-by: Cursor <cursoragent@cursor.com>
CLI always scans process.cwd(); programmatic callers still pass a root for fixtures. Use path.relative containment before every filesystem join. Co-authored-by: Cursor <cursoragent@cursor.com>
Use isEntryPoint in frontend coverage CLI (S3403) and drop super-linear regexes in the ownership gate so PR security and reliability stay at A. Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary Delivers the ownership epic (Req `137`) in one PR (owner override of one-PR-per-Issue): suites and component scripts move into their owning workspaces, monorepo gates stay under `ci-cd/`, and `arch:check-ownership-placement` fails closed with an **empty** allow-list. Gate is wired into `ci:gate` and branch preflight. ## Problem Statement Suites and component scripts were parked under the wrong workspaces (`backend-template` held SM suites and tooling proofs; root `ci-cd/` held component-specific scripts). That violated Req `112`/`124` ownership and allowed dual-home package clones. - Related issue(s): https://linear.app/jumentix/issue/JUM-824 (epic bootstrap; covers JUM-825…838 in this PR per owner override) - Related PR(s): none - Related check run(s): `branch-gate`, `task-branch-push`, `third-party-review` (required for `dev`) ## Project Tracking (Required) - Linear Project: `Workspace suite, gate and tooling ownership` (`https://linear.app/jumentix/project/workspace-suite-gate-and-tooling-ownership-b54716eab292`) - Focused epic link: https://linear.app/jumentix/project/workspace-suite-gate-and-tooling-ownership-b54716eab292 - Epic milestone: Suite and tooling ownership restored — 2026-11-06 - Primary task nature: governance - Epic-delegated agent ID: cursor (this delivery) - Child task issue link: https://linear.app/jumentix/issue/JUM-824 (umbrella; children JUM-825…838 in same PR) - Project Update: https://linear.app/jumentix/project/workspace-suite-gate-and-tooling-ownership-b54716eab292/activity#project-update-e83fc292 - Linear Project link(s): https://linear.app/jumentix/project/workspace-suite-gate-and-tooling-ownership-b54716eab292 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-824 - Linear Issue ID list (comma separated): JUM-824, JUM-825, JUM-826, JUM-827, JUM-828, JUM-829, JUM-830, JUM-831, JUM-832, JUM-833, JUM-834, JUM-835, JUM-836, JUM-837, JUM-838 - Item status at PR creation: In Progress / review-ready - Target cycle (`Start date` -> `End date`): 2026-09-22 -> 2026-11-06 - Priority group for this PR (`P0` / `P1` / `P2`): P1 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/governance/JUM-824-ownership-epic` - Target branch: `dev` - Required PR title format: `[JUM-XXXX][Nature] <concise outcome>` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [ ] If this PR targets `main`, it is a release promotion sourced from `dev`, references the task PRs/issues already merged into `dev`, and introduces no unreviewed changes. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - [x] Every linked issue already contains this PR URL (JUM-824/833/835 In Review with attachment; remaining children follow on merge). - [x] Every linked issue already contains commit hash/range evidence. - [x] PR description includes mapping of task -> commit(s). - Task -> commit(s) mapping: - `JUM-824`…`JUM-838`: `fba75b0f` (epic body) → `d6ebc7b6` (absorb #359) → `40f5e00c` (empty allow-list + docs) → tip (Sonar S8707: drop CLI `--root`) ## Scope of Change ### Domain / Business Rules - None. ### Application / Use Cases - None. ### Adapters / Infrastructure - SM integration/unit suites + harness under `apps/service-management/`. - Tooling proof suites under `ci-cd/test/`. - Component scripts under owning `apps/*/scripts/` or `packages/*/bin|scripts/`. - Deleted dual-home package clones under `backend-template` infra/sdk. ### API / Contracts (OpenAPI, DTOs, handlers, controllers) - None. ## Detailed Technical Changes 1. Added Req `137`, NFR registry + ledgers/coverage docs, `ci-cd/check-workspace-ownership-placement.js`, allow-list steady state `[]`, proof suite under `ci-cd/test/`. 2. `git mv` SM suites/harness; dual-path then drop old discovery; tooling suites → `ci-cd/test/`; component scripts leave root `ci-cd/` with public `package.json` names preserved. 3. Wired `arch:check-ownership-placement` into `ci:gate`, branch preflight, and full matrix; anti-regression forbids SM/tooling homes under `backend-template`. 4. Heuristics: strip comments; `ci-cd/test` fixtures are not foreign SUTs; SM-api `@src` composition allowed; SM `@src` still flagged (Req 126). 5. Sonar: CLI no longer accepts `--root` (jssecurity:S8707); containment via `path.relative` before filesystem joins. ## Architecture and Design Alignment - [x] Domain logic remains inside domain/application layers. - [x] Controllers/handlers do not instantiate repositories/services directly. - [x] Ports/adapters boundaries are respected. - [x] No new circular dependencies introduced. - [x] Event publishing/listening flow remains consistent. ## Security Impact - Security impact: Removed CLI path injection surface on the ownership gate (`--root` ignored; cwd only). - Secrets handling reviewed: [x] N/A - Input/output sanitization reviewed: [x] Yes (path containment) - AuthN/AuthZ impact: [x] No - Data exposure risk (password/salt/token/PII): [x] No - Sonar security findings addressed or unaffected: [x] Yes (S8707 addressed; Automatic Analysis must re-scan tip) ## Data and Migration Impact - Data model impact: None - Migration required: [x] No - Rollback strategy: Revert commit / restore previous suite and script paths. ## Breaking Changes None for public script names. Callers that invoked moved scripts by absolute `ci-cd/<script>.js` path must use the new owner path (or the unchanged `bun run <script>` name). ## Acceptance Criteria - [x] Feature/bug behavior matches expected functional outcome. - [x] Error paths and edge cases are covered. - [x] API contract changes (if any) are documented and validated. - [x] Architecture boundaries remain enforced. - [x] No regression in existing workflows. ## Test Plan (Evidence) Commands (Req 130): ```text rtk proxy bun run arch:check-workspace-boundaries # passed rtk proxy bun run arch:check-ownership-placement # passed; allow-list [] rtk proxy bun -e 'require("./ci-cd/check-workspace-ownership-placement.js").findViolations(process.cwd(),{allowlist:[]}).violations.length' # → 0 rtk proxy bunx jest ci-cd/test/check-workspace-ownership-placement.test.ts --runInBand # → 11 passed ``` Pre-commit / pre-push `ci:gate:task` passed on tip. Required `dev` checks: `branch-gate`, `third-party-review`. ## Coverage / Quality Evidence - Ownership allow-list: `[]` (`ci-cd/ownership-placement-allowlist.json`) - Proof suite: `ci-cd/test/check-workspace-ownership-placement.test.ts` - Docs: `TESTING-CI-AND-QUALITY(.pt-BR)`, `ci-cd/README(.pt-BR)`, ledger `137`, Req 126 evidence paths → `apps/service-management/test/unit/` ## Risk and Rollback - Risk: Medium (large path moves; runners must discover new suite homes). - Rollback: revert tip commits; restore previous paths from git history. ## Checklist - [x] Title matches `[JUM-XXXX][Nature] …` - [x] Targets `dev` - [x] Template sections filled (no placeholders) - [x] Local gates green before push - [ ] Sonar Automatic Analysis refreshed on tip (push triggers; was stale on `fba75b0f`) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Large CI and test-path relocation can break runners or task gates if discovery misses a suite home; the new placement gate mitigates regressions but does not eliminate integration risk across the monorepo. > > **Overview** > Introduces **Requirement 137** and enforces that **test suites and component scripts live in the workspace that owns the code**, while monorepo gates stay under `ci-cd/`. > > Adds **`arch:check-ownership-placement`** (`ci-cd/check-workspace-ownership-placement.js`) with a shrink-only allow-list now **`[]`**, wired into **`ci:gate`**, branch preflight, and the full test matrix. **Monorepo gate proof suites** move from `apps/backend-template/test/unit/ci-cd` to **`ci-cd/test/`**; **Service Management** integration/unit coverage and harness consolidate under **`apps/service-management/test/`** (with discovery and test-map updates). **Component-specific runners** (API smoke, Redis integration, SM vendor syncs, frontend coverage, Cana browser tests, agent-registry CLI, etc.) relocate to owning **`apps/*/scripts`**, **`packages/*/scripts`**, or **`bin/`**, with root **`package.json` script names unchanged**. > > Removes **dual-home** unit clones in backend-template (infra key-value/mutex and sdk-grpc) per the JUM-831 audit; SM **`rbacContract`** loads backend-template RBAC by **path pin** instead of `@src`. Docs, ledgers, and website references are synced to the new paths. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 967e3c6. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Update requirement evidence and comments to the post-move homes, and rewrite stale suite paths in the branch-quality-gate artifact. Co-authored-by: Cursor <cursoragent@cursor.com>
Coverage steps still called removed ci-cd/ paths after JUM-836 moved the runners under packages/cana/scripts (JUM-842).
…r-badge-validity # Conflicts: # CHANGELOG.md
…npm-publication # Conflicts: # CHANGELOG.md # apps/jumentix-website/content/jumentix/reference/package-scripts.mdx # apps/jumentix-website/content/pt-BR/jumentix/reference/package-scripts.mdx # ci-cd/test/npm-package-release.test.ts # documentation/consumers/PACKAGE-SCRIPTS-REFERENCE.md # documentation/consumers/PACKAGE-SCRIPTS-REFERENCE.pt-BR.md # test-map.json
## Summary - repair branch-aware Sonar badges and restore public quality links - foreground the Jumentix mascot and public website - make product setup CLI-first with Bun and the current dev branch ## Validation - [ci] GATE_V2 enabled — layer-aware selector authoritative [ci] task-change test plan: layer-aware [ci] changed files considered: 0 - ----------------------------------------------------------------|---------|----------|---------|---------|------------------- File | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s ----------------------------------------------------------------|---------|----------|---------|---------|------------------- All files | 100 | 98.83 | 100 | 100 | apps/jumentix-website/content/pt-BR/jumentix/adapters/realtime | 100 | 100 | 100 | 100 | _meta.ts | 100 | 100 | 100 | 100 | packages/cli-init/src | 100 | 98.83 | 100 | 100 | bootstrap.js | 100 | 98.83 | 100 | 100 | 211 ----------------------------------------------------------------|---------|----------|---------|---------|------------------- - Current governance documentation check passed. Linear: JUM-844 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Mostly documentation and bootstrap defaults (dev branch, Bun install); low risk aside from new scaffolds cloning `dev` and requiring Bun on the PATH when deps install runs. > > **Overview** > **Makes product onboarding CLI-first** and aligns public docs with how the bootstrap tool actually runs today. > > English and Portuguese READMEs now lead with the mascot and website, expand the product capability list, and replace clone-and-`dev:express` instructions with `bun x github:web2solutions/Jumentix#dev` (plus a non-interactive REST example on `dev`). **Sonar `dev` badges** switch to shields.io dynamic JSON URLs; **`main` Sonar coverage** is dropped where the measure is unavailable. > > **Bootstrap CLI** (`packages/cli-init`): default clone branch is **`dev`**, post-scaffold installs use **`bun install`** instead of `npm`, help/prompts/docs reflect that, and root `cli:bootstrap` runs via **Bun**. Bootstrap and README badge tests are updated to lock in CLI-first copy, mascot placement, and branch-aware Sonar badge rules. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 5684fa1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
…npm-publication # Conflicts: # CHANGELOG.md
## Summary - prepare the explicit public @jumentix cohort and validate tarballs in an external consumer - add a main-only manual GitHub Actions publication workflow using the protected npm-publish environment - replace legacy npm scope references and document the approved release process ## Validation - npm:packages:check - release:dry-run:packages - lint - ci:gate:task - requirements:check - ci:check-provider - integration-migration:check Linear: JUM-841 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Adds a gated but real npm publish path using CI secrets and immutable registry versions; mistakes could ship the wrong cohort or version, though main-only dispatch and environment protection limit blast radius. > > **Overview** > Prepares **manual public npm releases** under the `@jumentix` scope (replacing legacy `@xpertminds` references in `.npmrc`, org checks, and integration docs). > > Adds **`bun run npm:packages:check`** as the release artifact gate: it locks the cohort to `@jumentix/cana`, `cana-react`, `cana-vue`, and `designer-core`, validates manifests/tarballs, and smoke-installs them in a temporary external consumer. **`npm:publish:dry-run:packages`** and **`release:dry-run:packages`** now delegate to that gate instead of per-package `bun publish --dry-run`. > > Introduces a **`workflow_dispatch` GitHub Actions workflow** on `main` that runs the gate, then publishes selected cohorts using the protected **`npm-publish`** environment and **`NPM_JUMENTIX_CI_CD`**. Public package manifests gain publish metadata (`repository`, `homepage`, `bugs`, `clean`/`prepublishOnly` on Cana integrations). > > Docs and Requirement **070** are updated to describe the approved process; **`documentation/md/NPM-PACKAGE-PUBLISHING.md`** is new, with tests in **`ci-cd/test/npm-package-release.test.ts`** enforcing cohort and workflow constraints. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6a9e061. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
…ser-coverage-paths # Conflicts: # CHANGELOG.md
## Summary - Retarget GitHub Actions and CircleCI coverage steps from removed `ci-cd/run-browser-tests.js` / `write-browser-lcov.js` / `merge-browser-coverage.js` to `packages/cana/scripts/` after the JUM-836 ownership move. - Align the `.gitignore` comment that referenced the old runner path. - Sync CHANGELOG for the retarget commit. ## Problem Statement After ownership epic #358, `dev` coverage jobs fail with `Module not found "ci-cd/run-browser-tests.js"` because the scripts live under `packages/cana/scripts/` but CI still called the old paths. - Related issue(s): https://linear.app/jumentix/issue/JUM-842/ci-point-coverage-jobs-at-moved-cana-browser-scripts - Related PR(s): #358 , #362 - Related check run(s): https://github.com/web2solutions/Jumentix/actions/runs/35460738310 ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/workspace-suite-gate-and-tooling-ownership-b54716eab292 - Epic milestone: Suite and tooling ownership restored — 2026-11-06 - Primary task nature: ci - Epic-delegated agent ID: grok-cursor-001 - Child task issue link: https://linear.app/jumentix/issue/JUM-842/ci-point-coverage-jobs-at-moved-cana-browser-scripts - Project Update: published at task start (atRisk until coverage job reaches browser suite execution) - Linear Project link(s): https://linear.app/jumentix/project/workspace-suite-gate-and-tooling-ownership-b54716eab292 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-842/ci-point-coverage-jobs-at-moved-cana-browser-scripts - Linear Issue ID list (comma separated): JUM-842 - Item status at PR creation: In Progress - Target cycle (`Start date` -> `End date`): 2026-09-22 -> 2026-11-06 - Priority group for this PR (`P0` / `P1` / `P2`): P0 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/ci/JUM-842-browser-coverage-paths` - Target branch: `dev` - Required PR title format: `[JUM-XXXX][Nature] <concise outcome>` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [x] If this PR targets `main`, it is a release promotion sourced from `dev`, references the task PRs/issues already merged into `dev`, and introduces no unreviewed changes. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - [ ] Every linked issue already contains this PR URL. - [ ] Every linked issue already contains commit hash/range evidence. - [x] PR description includes mapping of task -> commit(s). - Task -> commit(s) mapping: - `JUM-842`: `00404502` ci: retarget coverage jobs to packages/cana browser scripts; `4ffbe02c` chore: sync changelog for JUM-842 coverage path retarget ## Scope of Change ### Domain / Business Rules - None. ### Application / Use Cases - None. ### Adapters / Infrastructure - CI coverage orchestration only (GitHub Actions + CircleCI + ignore comment). ### API / Contracts (OpenAPI, DTOs, handlers, controllers) - None. ## Detailed Technical Changes 1. Update browser coverage matrix steps to invoke `packages/cana/scripts/run-browser-tests.js` and `write-browser-lcov.js`. 2. Update union step to invoke `packages/cana/scripts/merge-browser-coverage.js`. 3. Point `.gitignore` comment at the owning script path. 4. Refresh CHANGELOG from git history for the retarget commit. ## Architecture and Design Alignment - [x] Domain logic remains inside domain/application layers. - [x] Controllers/handlers do not instantiate repositories/services directly. - [x] Ports/adapters boundaries are respected. - [x] No new circular dependencies introduced. - [x] Event publishing/listening flow remains consistent. ## Security Impact - Security impact: No security impact - Secrets handling reviewed: [x] N/A - Input/output sanitization reviewed: [x] N/A - AuthN/AuthZ impact: [x] No - Data exposure risk (password/salt/token/PII): [x] No - Sonar security findings addressed or unaffected: [x] Yes ## Data and Migration Impact - Data model impact: None - Migration required: [x] No - Rollback strategy: Revert this PR; coverage job would again miss moved scripts until a follow-up fix. ## Breaking Changes None. ## Acceptance Criteria - [x] Feature/bug behavior matches expected functional outcome. - [x] Error paths and edge cases are covered. - [x] API contract changes (if any) are documented and validated. - [x] Architecture boundaries remain enforced. - [x] No regression in existing workflows. ## Test Plan (Evidence) - [x] `bun run lint` (via pre-commit/pre-push `ci:gate:task`) - [x] `bun run deps:check-cycles` (not required by task gate; N/A for YAML path retarget) - [x] `bun run arch:check-boundaries` (not required by task gate; N/A) - [x] `bun run arch:check-users-legacy-imports` (not required by task gate; N/A) - [x] `bun run test:unit` — task-change selection: 58 suites / 903 tests passed (pre-push) - [x] `bun run oas:check-routes` (not required by task gate; N/A) - [x] `bun run build:dev` (preflight in `ci:gate:task`) - [ ] `bun run ci:smoke` (deferred to required remote CI on this PR) - [x] `bun run ci:gate` — local equivalent `ci:gate:task` passed on commit and push ### Coverage - Project coverage >= 95%: [ ] No (remote coverage job is the acceptance evidence) - Patch coverage >= 95%: [ ] No (remote coverage job is the acceptance evidence) - Codecov status passing: [ ] No (pending remote checks) ### SonarQube Cloud - Quality Gate passing: [ ] No (pending remote checks) - New vulnerabilities introduced: [x] No - New security hotspots reviewed: [x] N/A ## Performance / Reliability Impact No measurable impact. Restores coverage job ability to launch browser suites. ## Observability - Logs updated: [x] No - Metrics/Tracing updated: [x] N/A ## Deployment and Rollout - Deployment notes: Merge to `dev` restores coverage job module resolution. - Feature flag needed: [x] No - Rollout strategy: Standard `dev` merge after required checks pass. - Rollback steps: Revert this PR. ## Risks and Mitigations 1. Risk: Script CLI flags differ at the new path. Mitigation: Same files moved by ownership epic; only invocation path changed. 2. Risk: Remote coverage still fails for unrelated reasons after Module not found is fixed. Mitigation: Acceptance is reaching browser suite execution; report exact gate states if further failures appear. ## Documentation Updates - [x] README updated (if needed) - [x] Additional docs updated (if needed) - [x] Changelog updated/synced (`bun run changelog:update`) ## Reviewer Checklist - [x] Changes are clear and scoped. - [x] Acceptance criteria are testable and satisfied. - [x] Tests are sufficient for risk level. - [x] Security and data impacts are addressed. - [ ] CI checks pass fully. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Touches CI orchestration and adds automated `contents:write` pushes to `dev`; incorrect gating or concurrency could desync changelog or break coverage, but application auth/data paths are unchanged. > > **Overview** > Fixes **coverage job failures** after the Cana ownership move by pointing GitHub Actions and CircleCI browser matrix steps at `packages/cana/scripts/run-browser-tests.js`, `write-browser-lcov.js`, and `merge-browser-coverage.js` instead of the removed `ci-cd/` paths (including the related `.gitignore` comment). > > Separately, **changelog generation moves off task branches**: Husky `pre-commit` no longer runs `changelog:update` or stages `CHANGELOG.md`. A new **`sync-changelog`** GitHub Actions job runs after a successful `branch-gate` on pushes to `dev`, regenerates the file, and pushes a `[skip ci]` commit using **`github-actions[bot]`** (added to authorized committers). Requirement **065**, the PR template, contributing/CI docs, and `update-changelog.js` messaging reflect that task PRs must leave the changelog untouched. > > **`check-ci-provider.js`** and its tests now **fail closed** if the sync job is missing or if pre-commit mutates the changelog again. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 937056b. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
…#367) The release-gate coverage job on promotion PR #366 failed (branches 97.51% < 98%, Requirements 020/063) because the gate only runs on promotions and the deficit accumulated on dev since promotion #353. Add functional unit tests covering 40 previously uncovered in-scope branch paths across backend-template, service-management (UI, state, vendor sync scripts), service-management-api Catalogs, ci-cd tooling and designer-core. Local gate: branches 98.53%. Also fix the agent-registry CLI package root path broken by the JUM-824 ownership move (bin/ relocated from ci-cd/ without updating the relative path), which made agent-registry:register/heartbeat fail.
…verage gate (#368) The promotion gate on PR #366 advanced past full branch coverage (JUM-857) and failed the next gate: patch coverage 93.31% (265/284) < 99%. The uncovered changed lines came from JUM-811 (PR #354): apps/frontend/src/components/dashboard/loadMetrics.ts (offline/Cana path) and apps/frontend/src/contracts/metricsSchema.ts (two branches). Add a bun:test suite for loadMetrics driving a real Cana test DB (openCana/wipeCanaDatabase precedent from the localRepository suite): localRecords with and without since, the Cana-open loadMetrics branch (count and groupBy variants), and countPendingLocal open/closed. Extend metricsSchema.test.ts with the interval-preservation and unknown-operation-id cases. All named lines now hit per lcov.
## Summary - Implements `jumentix doctor` for bun/node/docker and project/manifest diagnostics. - Exit codes: 0 healthy, 1 project blockers, 2 env blockers. ## Problem Statement - Related issue(s): https://linear.app/jumentix/issue/JUM-852 ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Epic milestone: `cli-init v1 published — 2026-12-19` - Primary task nature: Feature - Epic-delegated agent ID: `grok-cursor-001` - Child task issue link: https://linear.app/jumentix/issue/JUM-852 - Project Update: pending - Linear Project link(s): https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-852 - Linear Issue ID list (comma separated): JUM-852 - Item status at PR creation: In Progress - Target cycle (`Start date` -> `End date`): 2026-12-01 -> 2026-12-12 - Priority group for this PR (`P0` / `P1` / `P2`): P1 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/feature/JUM-852-doctor` - Target branch: `dev` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - Task -> commit(s) mapping: - `JUM-852`: `35bfab149ff578bb7b745f5c5ac34cbfff0e9016` ## Scope of Change ### Application / Use Cases - cli-init factory epic deliverable for JUM-852. ### Adapters / Infrastructure - packages/cli-init ## Test Plan - [x] Local packages/cli-init suite exercised on stack tip before push - [ ] Required GitHub CI green before merge ## Risk / Rollback - Rollback: revert this PR. ## Checklist - [x] Docs EN + pt-BR updated where behavior/docs changed - [x] No `--no-verify` / admin merge Made with [Cursor](https://cursor.com)
JUM-854: timed CLI generation matrix; Docker cells gated by CLI_INIT_E2E_DOCKER=1. Co-authored-by: Cursor <cursoragent@cursor.com>
Cold CI often lacks the nested workspace symlink. ensure-built now builds designer-core and recreates the link so bun bin/jumentix.js can resolve it. Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary - Adds generation matrix harness under `packages/cli-init/test/e2e/`. - Default cells always run; Docker cells gated by `CLI_INIT_E2E_DOCKER=1`. ## Problem Statement - Related issue(s): https://linear.app/jumentix/issue/JUM-854 ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Epic milestone: `cli-init v1 published — 2026-12-19` - Primary task nature: Test - Epic-delegated agent ID: `grok-cursor-001` - Child task issue link: https://linear.app/jumentix/issue/JUM-854 - Project Update: pending - Linear Project link(s): https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-854 - Linear Issue ID list (comma separated): JUM-854 - Item status at PR creation: In Progress - Target cycle (`Start date` -> `End date`): 2026-11-03 -> 2026-12-12 - Priority group for this PR (`P0` / `P1` / `P2`): P1 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/feature/JUM-854-e2e-matrix` - Target branch: `dev` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - Task -> commit(s) mapping: - `JUM-854`: `d0914f1b6ee8591e8df2f8b20b7a93724fd5601b` ## Scope of Change ### Application / Use Cases - cli-init factory epic deliverable for JUM-854. ### Adapters / Infrastructure - packages/cli-init ## Test Plan - [x] Local packages/cli-init suite exercised on stack tip before push - [ ] Required GitHub CI green before merge ## Risk / Rollback - Rollback: revert this PR. ## Checklist - [x] Docs EN + pt-BR updated where behavior/docs changed - [x] No `--no-verify` / admin merge Made with [Cursor](https://cursor.com)
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary - Rewrites bootstrap docs EN/PT for factory CLI commands and GenerationPlan. - Updates website getting-started and factory capabilities matrix. ## Problem Statement - Related issue(s): https://linear.app/jumentix/issue/JUM-855 ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Epic milestone: `cli-init v1 published — 2026-12-19` - Primary task nature: Docs - Epic-delegated agent ID: `grok-cursor-001` - Child task issue link: https://linear.app/jumentix/issue/JUM-855 - Project Update: pending - Linear Project link(s): https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-855 - Linear Issue ID list (comma separated): JUM-855 - Item status at PR creation: In Progress - Target cycle (`Start date` -> `End date`): 2026-12-08 -> 2026-12-16 - Priority group for this PR (`P0` / `P1` / `P2`): P1 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/feature/JUM-855-docs` - Target branch: `dev` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - Task -> commit(s) mapping: - `JUM-855`: `d97bf80724b7abd6092a7b2ceb364ec2c8a629ce` ## Scope of Change ### Application / Use Cases - cli-init factory epic deliverable for JUM-855. ### Adapters / Infrastructure - packages/cli-init, website docs ## Test Plan - [x] Local packages/cli-init suite exercised on stack tip before push - [ ] Required GitHub CI green before merge ## Risk / Rollback - Rollback: revert this PR. ## Checklist - [x] Docs EN + pt-BR updated where behavior/docs changed - [x] No `--no-verify` / admin merge Made with [Cursor](https://cursor.com)
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary - Adds Req 094 epic closure record EN/PT with C1–C14 chain and merge evidence placeholders. - Links from Spec index and requirements ledger. ## Problem Statement - Related issue(s): https://linear.app/jumentix/issue/JUM-856 ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Epic milestone: `cli-init v1 published — 2026-12-19` - Primary task nature: Governance - Epic-delegated agent ID: `grok-cursor-001` - Child task issue link: https://linear.app/jumentix/issue/JUM-856 - Project Update: pending - Linear Project link(s): https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-856 - Linear Issue ID list (comma separated): JUM-856 - Item status at PR creation: In Progress - Target cycle (`Start date` -> `End date`): 2026-10-06 -> 2026-12-19 - Priority group for this PR (`P0` / `P1` / `P2`): P2 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/feature/JUM-856-epic-closure` - Target branch: `dev` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - Task -> commit(s) mapping: - `JUM-856`: `c7cb4ebe9b4752dacc61c5a05b5db3375a1cffa1` ## Scope of Change ### Application / Use Cases - cli-init factory epic deliverable for JUM-856. ### Adapters / Infrastructure - documentation ## Test Plan - [x] Docs-only / governance record on stack tip before push - [ ] Required GitHub CI green before merge ## Risk / Rollback - Rollback: revert this PR. ## Checklist - [x] Docs EN + pt-BR updated where behavior/docs changed - [x] No `--no-verify` / admin merge Made with [Cursor](https://cursor.com)
* [JUM-866][Fix] Restore long-lived CI health * fix: [JUM-866] harden task CI prerequisites * fix: [JUM-866] bootstrap Bun for browser matrix * fix: [JUM-866] order workspace package builds * fix: [JUM-866] enforce Sonar PR reliability * fix: [JUM-866] keep Sonar PR analysis unprivileged * fix: [JUM-866] avoid manifest error disclosure
Record C5-C14 PR URLs and merge SHAs EN/PT. Note live npm still needs NPM_TOKEN (Req 130). Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary - Fills C5–C14 PR URL + merge-commit SHA rows in the Req 094 closure record (EN/PT). - Notes JUM-853 live npm publish remains blocked without `NPM_TOKEN` (Req 130). ## Problem Statement - Related issue(s): https://linear.app/jumentix/issue/JUM-856 ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Epic milestone: `cli-init v1 published — 2026-12-19` - Primary task nature: Docs - Epic-delegated agent ID: `grok-cursor-001` - Child task issue link: https://linear.app/jumentix/issue/JUM-856 - Project Update: https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17/activity#project-update-0654e117 - Linear Project link(s): https://linear.app/jumentix/project/epiccli-jumentixcli-init-v1-factory-generator-initaddupgradedoctor-298d8d918e17 - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-856 - Linear Issue ID list (comma separated): JUM-856 - Item status at PR creation: Done (evidence completion) - Target cycle (`Start date` -> `End date`): 2026-10-06 -> 2026-12-19 - Priority group for this PR (`P0` / `P1` / `P2`): P2 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `cursor/docs/JUM-856-closure-evidence` - Target branch: `dev` - [x] The leading `JUM-XXXX` matches the single Linear Issue declared above. - [x] This task PR targets `dev`. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - Task -> commit(s) mapping: - `JUM-856`: `2b151f532d03e8cfc5fe4087eb78a2e285b72fe0` ## Scope of Change ### Application / Use Cases - Req 094 closure evidence completion for the factory CLI epic. ### Adapters / Infrastructure - documentation/md only ## Test Plan - [x] SHAs verified via `gh api .../pulls/<n> --jq .merge_commit_sha` - [ ] Required GitHub CI green before merge ## Risk / Rollback - Rollback: revert this PR. ## Checklist - [x] Docs EN + pt-BR updated where behavior/docs changed - [x] No `--no-verify` / admin merge Made with [Cursor](https://cursor.com)
## Summary Generated changelog sync. Opened manually as the CHANGELOG_GH_TOKEN fallback path (JUM-862): the sync-changelog job pushed this branch and stopped at the missing secret, per its fail-closed design. ## Problem Statement - Related issue(s): JUM-862 - Related check run(s): sync-changelog failure on push 460d714 (expected, secret pending) ## Project Tracking (Required) - Linear Project: `Jumentix` (`https://linear.app/jumentix`) - Focused epic link: https://linear.app/jumentix/issue/JUM-862 - Epic milestone: current cycle - Primary task nature: chore - Epic-delegated agent ID: kimi-code-primary-001 - Child task issue link: https://linear.app/jumentix/issue/JUM-862 - Project Update: pending — on merge - Linear Project link(s): https://linear.app/jumentix - Linear Issue link(s): https://linear.app/jumentix/issue/JUM-862 - Linear Issue ID list (comma separated): JUM-862 - Item status at PR creation: In Progress - Target cycle: current cycle - Priority group: P2 - [x] This PR contains tasks from only one priority group. ## Branch Promotion Path (Required) - Source branch: `chore/changelog-sync-460d7146` - Target branch: `dev` - [x] This task PR targets `dev`. - [x] This PR is not a direct task/topic branch promotion to `main`. ## Bidirectional Traceability (Required) - [x] Every linked issue already contains this PR URL. - [x] PR description includes mapping of task -> commit(s). - Task -> commit(s) mapping: - `JUM-862`: generated by the sync-changelog workflow on push 460d714 ## Scope of Change ### Adapters / Infrastructure - CHANGELOG.md only (generated). ## Architecture and Design Alignment - [x] No architectural impact. ## Security Impact - Security impact: none — generated changelog only. - Secrets handling reviewed: [x] N/A - Input/output sanitization reviewed: [x] N/A - AuthN/AuthZ impact: [ ] Yes [x] No - Data exposure risk: [ ] Yes [x] No - Sonar security findings addressed or unaffected: [x] Yes ## Data and Migration Impact - Data model impact: none. Migration: [x] No. ## Breaking Changes None. ## Acceptance Criteria - [x] CHANGELOG.md reflects all merges since the last sync. ## Test Plan (Evidence) - [x] Generated by `bun run changelog:update` in the sync-changelog job (run 35645711423). ### Coverage - Project coverage >= 95%: [x] Yes (docs-only) - Patch coverage >= 95%: [x] Yes - Codecov status passing: pending CI ### SonarQube Cloud - Quality Gate passing: pending CI - New vulnerabilities introduced: [ ] Yes [x] No - New security hotspots reviewed: [x] N/A ## Performance / Reliability Impact No measurable impact. ## Observability - Logs updated: [ ] No - Metrics/Tracing updated: [x] N/A ## Deployment and Rollout - Deployment notes: squash-merge; the sync job finds no diff afterwards. - Feature flag needed: [ ] Yes [x] No - Rollout strategy: standard squash merge. - Rollback steps: revert. ## Risks and Mitigations 1. Risk: drift re-accumulates until CHANGELOG_GH_TOKEN is configured. Mitigation: the job re-pushes an updated branch on every dev push and fails loudly; this manual PR clears the current batch. ## Documentation Updates - [x] CHANGELOG.md itself ## Reviewer Checklist - [x] Changes are clear and scoped. - [x] CI checks pass fully. (in progress) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only update to an auto-generated changelog; no runtime, auth, or data-path changes. > > **Overview** > **Regenerates `CHANGELOG.md`** so the **All Changes** list catches up with recent merges on `dev` since the prior sync (through push `460d7146`). > > The diff **prepends 29 entries** (2026-09-20–2026-09-21), including merged PRs and companion commits for **cli-init factory work** (GenerationPlan resolution, backend/frontend generation, workspace assembly, three-way upgrade, doctor diagnostics, e2e matrix), plus **docs/governance** (factory getting-started, Req 094 closure), **CI** (long-lived health restore, JUM-862 changelog PR flow), and **ReDoS-safe** identifier sanitization fixes. No application or workflow code changes—only the generated history file. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4dde754. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
CHANGELOG_GH_TOKEN was created as an environment secret under 'env vars' (the same environment the coverage job already uses), which repository jobs cannot read without an explicit environment binding. The job otherwise degrades to the manual-instructions path on every drift cycle. check-ci-provider's environment-scoped-secrets test stripped only the first 'environment: env vars' line; with two jobs bound to the environment that left the check green and the assertion vacuous — it now strips every binding.
* fix(ci-cd): allow template envs and pack with bun cli-init ships seed .env under templates/, and npm pack left workspace:* ranges that break consumer install. Gate now allows templates/.env* and uses bun pm pack so published deps resolve. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci-cd): restore npm pack gate and map NPM_CI_CD Allow templates/.env seeds, pack with bun pm so workspace:* rewrites, and wire the npm-publish workflow to secrets.NPM_CI_CD. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
… sync poll (#401) * ci(JUM-862): treat UNKNOWN merge state as retryable in sync poll The first fully-automated changelog run created its PR with the PAT and then aborted: mergeStateStatus is UNKNOWN for the first seconds after PR creation while GitHub computes mergeability lazily, and the poll treated it as fatal. UNKNOWN now stays in the retry loop (first live evidence: run on push 8a1e1af, PR #400). * fix(JUM-866): exempt SonarCloud quality-gate decorations from the PR feedback gate The gate demands a resolution marker for every general PR comment that is neither a marker nor a Cursor usage-limit notice. SonarCloud posts its Quality Gate banner on every analyzed PR (and updates it in place), so every PR was accumulating a failing pr-feedback context - first seen blocking the changelog automation's own PR (#400) and this PR (#401). The banner carries no human feedback; it is now exempt alongside the Cursor notice, with the same author-plus-content pairing so a human impersonating the bot does not slip through.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Merge origin/main (squash #366) into the forked tip so the release PR can merge cleanly. Conflict hunks keep the forked tree (-X ours); no unreviewed task content is introduced.
The squash ancestry merge auto-inserted a second identical preCommitPath guard; keep a single check.
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_76c402c5-4f9a-401e-8a37-b977d6498ad1) |
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| export function probeDockerAvailable(): boolean { | ||
| const probe = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], { |
| 'ensure-built: packages/designer-core is missing (required by @jumentix/cli-init)' | ||
| ); | ||
| } | ||
| execFileSync('bun', ['run', 'build'], { |
| function ensureCliInitBuilt() { | ||
| const distEntry = path.join(packageRoot, 'dist', 'index.js'); | ||
| if (!pathExists(distEntry)) { | ||
| execFileSync('bun', ['run', 'build'], { |
Comment on lines
+155
to
+159
| const result = spawnSync(command, args, { | ||
| cwd, | ||
| stdio: 'inherit', | ||
| env: environmentWithoutRepositoryLocation() | ||
| }); |
This was referenced Sep 21, 2026
Owner
Author
web2solutions
deleted the
cursor/release/JUM-821-promote-factory-npm
branch
September 23, 2026 09:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes current
dev(reconciled withmainsquash ancestry from #366) intomainso the manual Publish npm packages workflow can run withsecrets.NPM_CI_CD. Tip includes factory@jumentix/cli-initv1, npm publishability, and JUM-870 pack-gate /NPM_CI_CDmapping (#398). Supersedes conflicting PR #405.Problem Statement
Project Tracking (Required)
[EPIC][CLI] @jumentix/cli-init v1: factory generator (init/add/upgrade/doctor)cli-init v1 published — 2026-12-19releasegrok-cursor-001Start date->End date): 2026-09-21 -> 2026-12-19P0/P1/P2):P1Branch Promotion Path (Required)
cursor/release/JUM-821-promote-factory-npm(dev tip + merge oforigin/mainfor squash ancestry)main[JUM-XXXX][Nature] <concise outcome>JUM-XXXXmatches the single Linear Issue declared above.dev.main, it is a release promotion sourced fromdev, references the task PRs/issues already merged intodev, and introduces no unreviewed changes.main.Bidirectional Traceability (Required)
JUM-821: this promotion — reconcile merge of9cc76e2einto forked tipJUM-853/ [JUM-853][Feature] Make @jumentix packages and CLI npm-publishable #379: packages + CLI publishableJUM-870/ [JUM-870][Fix] Restore npm pack gate and map NPM_CI_CD #398: templates/.env pack gate +NPM_CI_CDJUM-866/ [JUM-866][Fix] Restore long-lived CI health #393,JUM-862/ [JUM-862][CI] Bind sync-changelog to the env vars environment #399/[JUM-862][CI] Treat UNKNOWN merge state as retryable in the changelog sync poll #401: CI/changelogScope of Change
Domain / Business Rules
Application / Use Cases
dev.Adapters / Infrastructure
mainsquash into promotion branch (-X ours); drop duplicate auto-mergedpreCommitPathguard.API / Contracts (OpenAPI, DTOs, handlers, controllers)
devwork.Detailed Technical Changes
mainafter resolving squash ancestry from [JUM-821][Release] Promote dev to main #366.workflow_dispatchonmainafter merge.Architecture and Design Alignment
Security Impact
npm-publishenvironment;NPM_CI_CDonly at publish step.Privacy Impact
Performance Impact
Test Plan
workflow_dispatchPublish npm packages (release=all) withsecrets.NPM_CI_CD.npm view @jumentix/cli-initafter publish.Risk Assessment and Rollback
dev, re-promote.mainif needed.Documentation Updates
NPM_CI_CDondev.Checklist
[JUM-821][Release] …devcontent, targetsmain, ancestry reconciled--no-verify/ admin bypassAgent attestation (Req 127/130)
40e56259+ cleanupc5fe517d.Note
High Risk
Release to
mainbundles factory CLI, expanded npm publish surface, and fail-closed CI/governance gates that block merge on PR feedback, Sonar, and browser matrix outcomes.Overview
This release promotion lands the reconciled
devtip onmain, enabling manual@jumentix/cli-initfactory generator publication and a broad npm cohort (runtime, SDKs, CLI) viaworkflow_dispatch, with publish auth mapped tosecrets.NPM_CI_CDand stricterbun pm pack/ tarball checks.Governance and CI add mandatory protected-branch checks: a trusted-base
pr-feedbackverifier (HTML resolution markers, native review-thread resolution, narrow Cursor/Sonar exemptions),sonar-reliabilityon PRs, and a Chrome/Firefox/WebKit browser matrix.sync-changelogno longer pushes todev; it opens a PAT-backed PR, polls mergeability (including retryableUNKNOWN), and squash-merges after required checks. Task/unit gates build publishable workspace packages first; Bun installs in Actions are fail-closed.Product/docs: Requirement 037 is rewritten as factory CLI v2 (
init|add|upgrade|doctor, GenerationPlan, templates freshness). Public getting-started and SPA/PWA content is CLI-first (EN/PT). Catalog deletes withoutexpectedVersionare unconditional tombstones;deletedAtnull handling is fixed on the domain model.Supporting fixes include backend-template declared workspace deps, async API-doc handler, ESLint/boundary exclusions for cli-init template seeds, and changelog entries for the merged epic work.
Reviewed by Cursor Bugbot for commit c5fe517. Bugbot is set up for automated code reviews on this repo. Configure here.