Development/Security: dependency ceilings, the real merge guarantee, and the CodeQL suite name
Development: document the two dependencies deliberately held below their newest
release -- the redis Python client at 5.x because arq pins redis<6, and
typescript below 6.1 because no published typescript-eslint declares support for
TypeScript >=6.1. Both produce a red CI rather than a working upgrade.
Development: the CI & contribution section claimed a pull request must be
up-to-date with main before merging. The ruleset does not require that. Replace
it with what actually holds: a pull_request run tests head merged into the base
tip at the time it runs, so a green check can be stale by the time the merge
happens; and on Dependabot pull requests the three required CodeQL Analyze
contexts never run, so those merges pass through the admin ruleset bypass.
Security: the scan table named the CodeQL query suite "security-and-quality".
Default setup does not offer that suite -- this repository is on "extended",
which resolves to security-extended, confirmed in the config API and in every
analysis's SARIF codeqlConfigSummary.
docs: comprehensive OPNGMS wiki (install, architecture, config, editor, log lake, security, reporting, ops)
Add the full operator + contributor manual as 12 wiki pages, every claim
grounded in the repository:
- Home / _Sidebar — overview and persistent navigation
- Installation — prerequisites, four TLS models, pull & start, first run
- Architecture — component diagram, services, data flows, RLS multi-tenancy
- Configuration — complete environment-variable reference
- Upgrading — pull+up flow, version pinning, backups, MASTER_KEY rotation
- Configuration-Editor — the version-aware editor & catalog pipeline (3a/3b
built; 3c diff/config.xml-map fenced as planned/not-built)
- Log-Lake — the optional mTLS syslog to OpenSearch lake
- Reporting — SMTP delivery, per-tenant settings, schedules
- Security — RLS, encrypted-at-rest secrets, MFA, CI scans, hardening
- Troubleshooting — grouped symptom to cause to fix
- Development — local dev, tests, CI, contribution flow
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>