Skip to content

v1.9

v1.9 — Backend Hygiene & Posture
@suculent suculent tagged this 04 Jun 11:35 
Delivered: Paid down the v1.x backlog the v1.0 GA explicitly deferred —
structural hygiene, security posture, auth/account lifecycle, and operational
guardrails — without breaking any legacy-console-compatible route the Vue
console inherited. 13/13 v1.9 requirements verified across 7 phases.

Key accomplishments:
- Phase 5 (REFACTOR-01/02/05): trust-proxy dedup, !==, jshint -> devDeps
- Phase 6 (REFACTOR-03 / SEC-WS-01 / SEC-COOKIE-01): WS close handler,
  httpOnly:true session cookie, edge-nginx routing runbook
- Phase 7 (REFACTOR-04): ~73 owner.js callbacks -> async/await, 6 atomic
  commits, 5 behavior-locking specs, 7 strict-equality fixes folded in
- Phase 8 (AUTH-REACTIVATE-01 / AUTH-RESET-LINK-CONSOLE): admin reactivate
  endpoint, reset-email URL -> Vue console
- Phase 9 (SEC-PII-02): managed_logs redaction CLI + audit.js 90-day TTL +
  runbook + GDPR-posture note (operator execution outstanding)
- Phase 10 (SEC-DEP-02): 2 console alerts classified deferred-vendored-asset,
  SEC-DEP-02 scheduled in services/console, submodule pointer bumped
- Phase 11 (BASE-IMG-01 / THINX-CERT-CHECK-01): base/update.sh hardened
  (18 -> 179 lines, shellcheck-clean); DETECT-only ca.pem freshness probe
  (R10..R14 chain check)

See .planning/MILESTONES.md for full details.
See .planning/milestones/v1.9-ROADMAP.md for archived phase scope.
Assets 2
Loading