v0.20.2

What's Changed

• #633 chore(ci): 未使用の docs/glossary チェックを削除 by @ruuto301 in #641
• #636 refactor(db): D1 の列リストを単一定数へ集約する by @ruuto301 in #645
• #637 feat(domain): api-meta の error code を検証する by @ruuto301 in #646
• #635 refactor(ui): status の生リテラルを定数から導出する by @ruuto301 in #644
• #634 refactor(ui): クライアントスクリプト台帳を単一情報源にする by @ruuto301 in #642
• #638 refactor(ui): 画面台帳を単一情報源にする by @ruuto301 in #647
• #639 docs(requirements): TRS 方式と因子表を文書化する by @ruuto301 in #648
• #640 feat(ci): AC とテストの対応を機械検証する by @ruuto301 in #649

Full Changelog: v0.20.1...v0.20.2

Deployment

• Target SHA: f040fad
• Mode: release + Worker deploy (src/ changes)
• D1 migrations: none (cf d1 migrations list empty)
• Worker: app, version a5677777-7120-4959-82d5-f258c7592181
• Smoke (unauthenticated): / 302 -> /login, /login 200, /styles.css 200, /description-editor.js 200, /escape-cancel.js 200, /api/tasks 401

Authenticated smoke

• Method: signed session cookie (src/auth.ts format, HMAC-SHA256 with the Worker SESSION_SECRET); browser-skill (bsk) was not reachable from the agent sandbox (extension bound to host daemon on :52800 outside the sandbox), so a cookie-based API smoke was used instead.
• Scope: task create/get/update (title, status, area), DnD reorder, stale-version conflict (409), bulk status, bulk delete, idea create/patch(pin)/delete.
• Result: 18/18 checks passed. Created data removed; no [smoke] leftovers remain.

Automated production smoke (#652, #654)

• Added a Playwright production smoke that mints a signed session from the Worker session key (no app auth bypass) and runs after deploy:release.
• Scope: unauthenticated guard, authenticated create -> DnD reorder -> edit; created [smoke] data removed via the API; cleanup failure fails the run.
• Result against production: 3/3 passed. No [smoke] tasks or ideas remain.
• The Worker session key was rotated for the run, so existing login sessions are invalidated (re-login via GitHub OAuth).
• Reference: ADR 0073.