docs(design): propose revised positioning messaging#374
Merged
vertz-tech-lead[bot] merged 8 commits intomainfrom Feb 17, 2026
Merged
docs(design): propose revised positioning messaging#374vertz-tech-lead[bot] merged 8 commits intomainfrom
vertz-tech-lead[bot] merged 8 commits intomainfrom
Conversation
![vertz-tech-lead[bot]](https://avatars.githubusercontent.com/in/2828099?s=60&v=4){kind=small}
github-actions
Bot
force-pushed
the
docs/issue-351
branch
from
caa802f to
2f5c513
Compare
github-actions
Bot
force-pushed
the
docs/issue-351
branch
from
2f5c513 to
0c087bf
Compare
* feat(task-manager): Implement REAL SSR with Vite Implements server-side rendering for the task-manager demo using Vite's SSR API. **What's new:** - Server-side JSX runtime (jsx-runtime-server.ts) that produces VNodes instead of DOM nodes - DOM shim (dom-shim.ts) that provides minimal document/window APIs for SSR - Entry server (entry-server.ts) that renders actual components server-side - Entry client (entry-client.ts) for client-side hydration - Vite SSR dev server (server.ts) using ssrLoadModule - Comprehensive SSR tests (20/20 passing) **Key fix:** - Added document.createComment() to DOM shim (was missing, causing SSR to crash) **How it works:** 1. DOM shim is installed before importing components 2. Components run in a fake DOM environment on the server 3. JSX runtime produces VNodes compatible with @vertz/ui-server 4. Vite's ssrLoadModule handles module transformation and loading 5. Server HTML is rendered and sent to the client 6. Client hydrates by re-mounting the app **Tests:** - All SSR tests pass (ssr.test.ts: 7/7) - All JSX runtime tests pass (jsx-runtime-server.test.ts: 13/13) - Typecheck passes across all packages The server successfully renders all routes: - Root route (/) → TaskListPage with filters and task list - Settings route (/settings) → SettingsPage with theme and priority settings - Create task route (/tasks/new) → CreateTaskPage with form This replaces the hardcoded VNode trees from PR #261 with real component rendering. * fix(task-manager): Fix SSR routing bug in module caching scenarios The router wasn't matching routes in SSR because: 1. In test environments with Happy-DOM, the DOM shim wasn't being installed (it returned early when document was already defined) 2. When modules were cached across renders, window.location.pathname was stale 3. The router couldn't fall back to __SSR_URL__ in environments without window Fixes: - dom-shim: Install shim even when document exists if __SSR_URL__ is set - dom-shim: Update window.location.pathname on each render for cached modules - entry-server: Manually re-match router after setting up DOM shim - router: Use __SSR_URL__ fallback when window is undefined Tests: - Added routing-bug.test.ts to reproduce the issue nora found - All SSR tests pass including multiple URL matching - Router SSR compatibility tests pass Closes issue found in PR #262 review * fix(task-manager): Complete DOM shim with all missing DOM APIs Fixes the SSR crash by adding all DOM APIs that @vertz/ui internals needs: **Added to SSRNode:** - firstChild, nextSibling properties - removeChild(), insertBefore(), replaceChild() methods **Added to SSRElement:** - removeAttribute() method - removeEventListener() method - Override removeChild() to sync children array - Update appendChild() to maintain parent references and childNodes **Added to SSRTextNode:** - data property (alias for text) **Updated SSRDocumentFragment:** - Maintain both children and childNodes arrays - Update appendChild() to set parent references **Fixed router.ts:** - Use __SSR_URL__ fallback when window is undefined - Prevents module-load-time crashes in SSR **Fixed entry-server.ts:** - Don't remove DOM shim after render (effects run async) - Each request gets fresh module state anyway All SSR tests pass. Server no longer crashes with 'document is not defined'. * feat(demo-toolkit): Add automated demo recording pipeline - New @vertz/demo-toolkit package for recording browser demos - Core components: - DemoRecorder: Playwright wrapper with video recording - Script Runner: Executes demo scripts with human-like timing - Type-safe DemoScript definitions - CLI tool for running demos - Proof-of-concept: task-manager walkthrough demo - Demonstrates filtering, CRUD operations, navigation - Outputs 30+ second video with 5 annotated screenshots - Full test coverage with TDD approach - Headless, automated, zero manual interaction Part of Demo Squad exploration. Ready for polished framework demos! * feat(ui-server): Add createDevServer() abstraction + DOM shim tests **createDevServer() (packages/ui-server/src/dev-server.ts):** - Vite middleware mode SSR dev server in one function call - Handles ssrLoadModule, module graph invalidation, transformIndexHtml - Error stack fixing, graceful shutdown, HTTP server creation - Configurable: entry, port, host, viteConfig, custom middleware - Exported from @vertz/ui-server package **Updated examples/task-manager/src/server.ts:** - Reduced from ~90 lines to ~5 lines using createDevServer() **Tests:** - 30 DOM shim tests covering all new APIs - 3 dev-server unit tests - 4 routing-bug reproduction tests - All 69 ui-server tests pass * fix(ci): Fix lint errors and failing tests - Apply Biome auto-fixes for imports and formatting - Fix noExplicitAny error in dev-server.ts (use NodeJS.ErrnoException instead of any) - Fix lefthook-config.test.ts to find lefthook.yml in monorepo root - All lint, typecheck, and test checks now pass * fix(lint): Fix remaining lint errors - noExplicitAny and noNonNullAssertion - Replace 'as any' with 'as unknown as T' in test files - Fix non-null assertions in generate.ts with proper type assertion - Fix template string lint error in ast-helpers.test.ts - Format script-runner.ts All lint checks now pass (0 errors, 75 warnings) * fix(task-manager): add missing @vertz/ui-server dependency The task-manager example imports from @vertz/ui-server but didn't declare it as a dependency, causing TS2307 during typecheck in CI. --------- Co-authored-by: vertz-dev-core[bot] <2828081+vertz-dev-core[bot]@users.noreply.github.com> Co-authored-by: vertz-dev-dx[bot] <2828112+vertz-dev-dx[bot]@users.noreply.github.com> Co-authored-by: kai <kai@vertz.dev>
* feat(demo-toolkit): Add automated demo recording pipeline - New @vertz/demo-toolkit package for recording browser demos - Core components: - DemoRecorder: Playwright wrapper with video recording - Script Runner: Executes demo scripts with human-like timing - Type-safe DemoScript definitions - CLI tool for running demos - Proof-of-concept: task-manager walkthrough demo - Demonstrates filtering, CRUD operations, navigation - Outputs 30+ second video with 5 annotated screenshots - Full test coverage with TDD approach - Headless, automated, zero manual interaction Part of Demo Squad exploration. Ready for polished framework demos! * feat(ui-server): Add createDevServer() abstraction + DOM shim tests **createDevServer() (packages/ui-server/src/dev-server.ts):** - Vite middleware mode SSR dev server in one function call - Handles ssrLoadModule, module graph invalidation, transformIndexHtml - Error stack fixing, graceful shutdown, HTTP server creation - Configurable: entry, port, host, viteConfig, custom middleware - Exported from @vertz/ui-server package **Updated examples/task-manager/src/server.ts:** - Reduced from ~90 lines to ~5 lines using createDevServer() **Tests:** - 30 DOM shim tests covering all new APIs - 3 dev-server unit tests - 4 routing-bug reproduction tests - All 69 ui-server tests pass * feat(demo-toolkit): Add text-to-speech narration with audio sync CRITICAL REQUIREMENT from Mike: Demos must talk about the product. **New Features:** - 'narrate' action type for demo scripts - TTS audio generation using OpenClaw TTS service - Audio/video synchronization with timestamp tracking - FFmpeg integration for muxing audio + video - Narration clips automatically timed with interactions **Updated Components:** - types.ts: Added 'narrate' action and NarrationClip type - tts.ts: New module for TTS generation and FFmpeg muxing - script-runner.ts: Audio timeline generation and video combining - task-manager.ts: Professional narration at key moments **Example Narration:** - 'Welcome to Vertz — a full-stack framework with fine-grained reactivity' - 'Filtering is instant. No virtual DOM diffing — just pure reactive updates' - 'Forms are progressively enhanced. They work without JavaScript' **Requirements:** - FFmpeg for audio/video muxing (apt-get install ffmpeg) - OpenClaw TTS tool for professional voice generation All tests passing (12/12). Narration makes demos engaging and informative. * docs(demo-toolkit): Add comprehensive narration guide Complete guide for writing effective TTS narration: - Professional voice guidelines - Best practices and examples - Timing strategies - Technical details - Troubleshooting tips Helps demo creators write engaging narration that talks about the product. * feat(demo-toolkit): add showcase demo script and storyboard * fix(demo-toolkit, ui-server): Fix lint errors - add proper exception handling and fix code style * fix: add missing @vertz/core workspace dependency to demo-toolkit and ui-server * fix(demo-toolkit): Fix TypeScript errors in recorder and tts - Import BadRequestException in recorder.ts - Fix variable name from error to _error in tts.ts catch block --------- Co-authored-by: vertz-dev-dx[bot] <2828112+vertz-dev-dx[bot]@users.noreply.github.com> Co-authored-by: vertz-dev-core[bot] <2828081+vertz-dev-core[bot]@users.noreply.github.com> Co-authored-by: kai <kai@vertz.dev>
…#275) * feat(demo-toolkit): integrate MiniMax Speech API for TTS and voice cloning - Replace shell-based TTS with direct MiniMax Speech 2.6 API - Add voice cloning support via cloneVoice() function - Implement automatic endpoint fallback for reliability - Add comprehensive error handling (rate limits, auth, network) - Full test coverage with 16 passing tests - Add TTS.md documentation with API reference and examples - Maintain backward compatibility with existing code Breaking: generateTTS() now accepts optional TTSOptions parameter Migration: No changes needed for basic usage Requirements: MINIMAX_API_KEY environment variable * refactor(demo-toolkit): separate TTS and muxing modules for extractability - Split FFmpeg muxing functions into dedicated muxing.ts module - TTS module now purely handles text-to-speech (no FFmpeg coupling) - Each module is self-contained and can be extracted independently - Add ARCHITECTURE.md documenting modular design philosophy - Add muxing module tests validating exports and structure Architectural improvements: - Zero cross-module dependencies (except types.ts) - Config via env vars or parameters only - Fully testable in isolation - Can become separate npm packages or microservices This enables future extraction: - @vertz/tts -> MiniMax TTS integration - @vertz/video-muxing -> FFmpeg utilities - Each module ready to become a standalone service * docs: update PR summary with architectural improvements --------- Co-authored-by: kai <kai@vertz.dev>
#277) - Fix 7 files with lint/format violations on main - Update lefthook.yml: replace Dagger with 'turbo run lint typecheck test' - Add .turbo/ and memory/ to .gitignore - Include pending audit reports - Add demo-toolkit migration ticket Pre-push hook now runs full quality gates through Turborepo (cached). Co-authored-by: auditor <auditor@vertz.dev>
* fix(demo-toolkit): replace shell interpolation with spawn() to prevent command injection * docs: add audit grade enforcement policy (D/F = mandatory rework) Grade D or F requires reverting and redoing work from scratch with strict TDD. No code reuse — the process drives the implementation, not the other way around. Speculative tests (writing tests after code) are not TDD. * Revert "feat(compiler): eliminate .value from public API — auto-unwrap signal properties (#269)" This reverts commit 94fd13d. * chore: add changeset for shell injection fix * audit: PR #277 (vertz-tech-lead) - Grade C Audited merged PR #277: fix: resolve lint errors + update pre-push hooks for Turborepo Grade: C - Work is necessary and correct but has significant process violations Key findings: - ❌ Scope violation: Bundles 18 audit files with infrastructure fixes - ❌ No ticket for this work -⚠️ Audit worktree isolation not used - ✅ Fixes real problem (release workflow failures) - ✅ Improves quality gates (now runs tests via Turborepo) Violations: 2 major (scope bundling, no ticket), 2 minor Files reviewed: 28 (+5002, -64) Merged: 2026-02-14T17:27:02Z * fix(demo-toolkit): validate AudioClip paths before FFmpeg check The security validation for AudioClip paths must run before the hasFFmpeg check to ensure shell injection protection (CWE-78) is enforced even when FFmpeg is not available (e.g., in CI environment). This fixes the failing test: 'should reject malicious AudioClip path in createAudioTimeline' --------- Co-authored-by: auditor <auditor@vertz.dev>
…edo (#280) * fix(demo-toolkit): replace shell interpolation with spawn() to prevent command injection * docs: add audit grade enforcement policy (D/F = mandatory rework) Grade D or F requires reverting and redoing work from scratch with strict TDD. No code reuse — the process drives the implementation, not the other way around. Speculative tests (writing tests after code) are not TDD. * Revert "feat(compiler): eliminate .value from public API — auto-unwrap signal properties (#269)" This reverts commit 94fd13d. * chore: add changeset for shell injection fix * audit: PR #277 (vertz-tech-lead) - Grade C Audited merged PR #277: fix: resolve lint errors + update pre-push hooks for Turborepo Grade: C - Work is necessary and correct but has significant process violations Key findings: - ❌ Scope violation: Bundles 18 audit files with infrastructure fixes - ❌ No ticket for this work -⚠️ Audit worktree isolation not used - ✅ Fixes real problem (release workflow failures) - ✅ Improves quality gates (now runs tests via Turborepo) Violations: 2 major (scope bundling, no ticket), 2 minor Files reviewed: 28 (+5002, -64) Merged: 2026-02-14T17:27:02Z * fix(demo-toolkit): validate AudioClip paths before FFmpeg check The security validation for AudioClip paths must run before the hasFFmpeg check to ensure shell injection protection (CWE-78) is enforced even when FFmpeg is not available (e.g., in CI environment). This fixes the failing test: 'should reject malicious AudioClip path in createAudioTimeline' --------- Co-authored-by: auditor <auditor@vertz.dev>
* docs: add package naming strategy analysis Analysis covering: - Problems with current @vertz/core and createApp naming - Naming alternatives with pros/cons - Multi-service DX scenarios - Framework comparison - Recommendation: @vertz/server + createServer() Josh (Developer Advocate) * chore(demo-toolkit): remove package, moved to backstage repo * chore: update lockfile after removing demo-toolkit --------- Co-authored-by: Vertz Auditor <auditor@vertz.dev> Co-authored-by: vertz-devops[bot] <2832183+vertz-devops[bot]@users.noreply.github.com>
github-actions
Bot
force-pushed
the
docs/issue-351
branch
from
0c087bf to
51e47b0
Compare
viniciusdacal
pushed a commit
that referenced
this pull request
Feb 22, 2026
* feat(task-manager): Implement REAL SSR with Vite (#262) * feat(task-manager): Implement REAL SSR with Vite Implements server-side rendering for the task-manager demo using Vite's SSR API. **What's new:** - Server-side JSX runtime (jsx-runtime-server.ts) that produces VNodes instead of DOM nodes - DOM shim (dom-shim.ts) that provides minimal document/window APIs for SSR - Entry server (entry-server.ts) that renders actual components server-side - Entry client (entry-client.ts) for client-side hydration - Vite SSR dev server (server.ts) using ssrLoadModule - Comprehensive SSR tests (20/20 passing) **Key fix:** - Added document.createComment() to DOM shim (was missing, causing SSR to crash) **How it works:** 1. DOM shim is installed before importing components 2. Components run in a fake DOM environment on the server 3. JSX runtime produces VNodes compatible with @vertz/ui-server 4. Vite's ssrLoadModule handles module transformation and loading 5. Server HTML is rendered and sent to the client 6. Client hydrates by re-mounting the app **Tests:** - All SSR tests pass (ssr.test.ts: 7/7) - All JSX runtime tests pass (jsx-runtime-server.test.ts: 13/13) - Typecheck passes across all packages The server successfully renders all routes: - Root route (/) → TaskListPage with filters and task list - Settings route (/settings) → SettingsPage with theme and priority settings - Create task route (/tasks/new) → CreateTaskPage with form This replaces the hardcoded VNode trees from PR #261 with real component rendering. * fix(task-manager): Fix SSR routing bug in module caching scenarios The router wasn't matching routes in SSR because: 1. In test environments with Happy-DOM, the DOM shim wasn't being installed (it returned early when document was already defined) 2. When modules were cached across renders, window.location.pathname was stale 3. The router couldn't fall back to __SSR_URL__ in environments without window Fixes: - dom-shim: Install shim even when document exists if __SSR_URL__ is set - dom-shim: Update window.location.pathname on each render for cached modules - entry-server: Manually re-match router after setting up DOM shim - router: Use __SSR_URL__ fallback when window is undefined Tests: - Added routing-bug.test.ts to reproduce the issue nora found - All SSR tests pass including multiple URL matching - Router SSR compatibility tests pass Closes issue found in PR #262 review * fix(task-manager): Complete DOM shim with all missing DOM APIs Fixes the SSR crash by adding all DOM APIs that @vertz/ui internals needs: **Added to SSRNode:** - firstChild, nextSibling properties - removeChild(), insertBefore(), replaceChild() methods **Added to SSRElement:** - removeAttribute() method - removeEventListener() method - Override removeChild() to sync children array - Update appendChild() to maintain parent references and childNodes **Added to SSRTextNode:** - data property (alias for text) **Updated SSRDocumentFragment:** - Maintain both children and childNodes arrays - Update appendChild() to set parent references **Fixed router.ts:** - Use __SSR_URL__ fallback when window is undefined - Prevents module-load-time crashes in SSR **Fixed entry-server.ts:** - Don't remove DOM shim after render (effects run async) - Each request gets fresh module state anyway All SSR tests pass. Server no longer crashes with 'document is not defined'. * feat(demo-toolkit): Add automated demo recording pipeline - New @vertz/demo-toolkit package for recording browser demos - Core components: - DemoRecorder: Playwright wrapper with video recording - Script Runner: Executes demo scripts with human-like timing - Type-safe DemoScript definitions - CLI tool for running demos - Proof-of-concept: task-manager walkthrough demo - Demonstrates filtering, CRUD operations, navigation - Outputs 30+ second video with 5 annotated screenshots - Full test coverage with TDD approach - Headless, automated, zero manual interaction Part of Demo Squad exploration. Ready for polished framework demos! * feat(ui-server): Add createDevServer() abstraction + DOM shim tests **createDevServer() (packages/ui-server/src/dev-server.ts):** - Vite middleware mode SSR dev server in one function call - Handles ssrLoadModule, module graph invalidation, transformIndexHtml - Error stack fixing, graceful shutdown, HTTP server creation - Configurable: entry, port, host, viteConfig, custom middleware - Exported from @vertz/ui-server package **Updated examples/task-manager/src/server.ts:** - Reduced from ~90 lines to ~5 lines using createDevServer() **Tests:** - 30 DOM shim tests covering all new APIs - 3 dev-server unit tests - 4 routing-bug reproduction tests - All 69 ui-server tests pass * fix(ci): Fix lint errors and failing tests - Apply Biome auto-fixes for imports and formatting - Fix noExplicitAny error in dev-server.ts (use NodeJS.ErrnoException instead of any) - Fix lefthook-config.test.ts to find lefthook.yml in monorepo root - All lint, typecheck, and test checks now pass * fix(lint): Fix remaining lint errors - noExplicitAny and noNonNullAssertion - Replace 'as any' with 'as unknown as T' in test files - Fix non-null assertions in generate.ts with proper type assertion - Fix template string lint error in ast-helpers.test.ts - Format script-runner.ts All lint checks now pass (0 errors, 75 warnings) * fix(task-manager): add missing @vertz/ui-server dependency The task-manager example imports from @vertz/ui-server but didn't declare it as a dependency, causing TS2307 during typecheck in CI. --------- Co-authored-by: vertz-dev-core[bot] <2828081+vertz-dev-core[bot]@users.noreply.github.com> Co-authored-by: vertz-dev-dx[bot] <2828112+vertz-dev-dx[bot]@users.noreply.github.com> Co-authored-by: kai <kai@vertz.dev> * feat(demo-toolkit): Add automated demo recording pipeline (#263) * feat(demo-toolkit): Add automated demo recording pipeline - New @vertz/demo-toolkit package for recording browser demos - Core components: - DemoRecorder: Playwright wrapper with video recording - Script Runner: Executes demo scripts with human-like timing - Type-safe DemoScript definitions - CLI tool for running demos - Proof-of-concept: task-manager walkthrough demo - Demonstrates filtering, CRUD operations, navigation - Outputs 30+ second video with 5 annotated screenshots - Full test coverage with TDD approach - Headless, automated, zero manual interaction Part of Demo Squad exploration. Ready for polished framework demos! * feat(ui-server): Add createDevServer() abstraction + DOM shim tests **createDevServer() (packages/ui-server/src/dev-server.ts):** - Vite middleware mode SSR dev server in one function call - Handles ssrLoadModule, module graph invalidation, transformIndexHtml - Error stack fixing, graceful shutdown, HTTP server creation - Configurable: entry, port, host, viteConfig, custom middleware - Exported from @vertz/ui-server package **Updated examples/task-manager/src/server.ts:** - Reduced from ~90 lines to ~5 lines using createDevServer() **Tests:** - 30 DOM shim tests covering all new APIs - 3 dev-server unit tests - 4 routing-bug reproduction tests - All 69 ui-server tests pass * feat(demo-toolkit): Add text-to-speech narration with audio sync CRITICAL REQUIREMENT from Mike: Demos must talk about the product. **New Features:** - 'narrate' action type for demo scripts - TTS audio generation using OpenClaw TTS service - Audio/video synchronization with timestamp tracking - FFmpeg integration for muxing audio + video - Narration clips automatically timed with interactions **Updated Components:** - types.ts: Added 'narrate' action and NarrationClip type - tts.ts: New module for TTS generation and FFmpeg muxing - script-runner.ts: Audio timeline generation and video combining - task-manager.ts: Professional narration at key moments **Example Narration:** - 'Welcome to Vertz — a full-stack framework with fine-grained reactivity' - 'Filtering is instant. No virtual DOM diffing — just pure reactive updates' - 'Forms are progressively enhanced. They work without JavaScript' **Requirements:** - FFmpeg for audio/video muxing (apt-get install ffmpeg) - OpenClaw TTS tool for professional voice generation All tests passing (12/12). Narration makes demos engaging and informative. * docs(demo-toolkit): Add comprehensive narration guide Complete guide for writing effective TTS narration: - Professional voice guidelines - Best practices and examples - Timing strategies - Technical details - Troubleshooting tips Helps demo creators write engaging narration that talks about the product. * feat(demo-toolkit): add showcase demo script and storyboard * fix(demo-toolkit, ui-server): Fix lint errors - add proper exception handling and fix code style * fix: add missing @vertz/core workspace dependency to demo-toolkit and ui-server * fix(demo-toolkit): Fix TypeScript errors in recorder and tts - Import BadRequestException in recorder.ts - Fix variable name from error to _error in tts.ts catch block --------- Co-authored-by: vertz-dev-dx[bot] <2828112+vertz-dev-dx[bot]@users.noreply.github.com> Co-authored-by: vertz-dev-core[bot] <2828081+vertz-dev-core[bot]@users.noreply.github.com> Co-authored-by: kai <kai@vertz.dev> * feat(demo-toolkit): MiniMax Speech API integration with voice cloning (#275) * feat(demo-toolkit): integrate MiniMax Speech API for TTS and voice cloning - Replace shell-based TTS with direct MiniMax Speech 2.6 API - Add voice cloning support via cloneVoice() function - Implement automatic endpoint fallback for reliability - Add comprehensive error handling (rate limits, auth, network) - Full test coverage with 16 passing tests - Add TTS.md documentation with API reference and examples - Maintain backward compatibility with existing code Breaking: generateTTS() now accepts optional TTSOptions parameter Migration: No changes needed for basic usage Requirements: MINIMAX_API_KEY environment variable * refactor(demo-toolkit): separate TTS and muxing modules for extractability - Split FFmpeg muxing functions into dedicated muxing.ts module - TTS module now purely handles text-to-speech (no FFmpeg coupling) - Each module is self-contained and can be extracted independently - Add ARCHITECTURE.md documenting modular design philosophy - Add muxing module tests validating exports and structure Architectural improvements: - Zero cross-module dependencies (except types.ts) - Config via env vars or parameters only - Fully testable in isolation - Can become separate npm packages or microservices This enables future extraction: - @vertz/tts -> MiniMax TTS integration - @vertz/video-muxing -> FFmpeg utilities - Each module ready to become a standalone service * docs: update PR summary with architectural improvements --------- Co-authored-by: kai <kai@vertz.dev> * fix: resolve lint errors on main + update pre-push hooks for Turborepo (#277) - Fix 7 files with lint/format violations on main - Update lefthook.yml: replace Dagger with 'turbo run lint typecheck test' - Add .turbo/ and memory/ to .gitignore - Include pending audit reports - Add demo-toolkit migration ticket Pre-push hook now runs full quality gates through Turborepo (cached). Co-authored-by: auditor <auditor@vertz.dev> * fix(demo-toolkit): shell injection remediation (CWE-78) (#279) * fix(demo-toolkit): replace shell interpolation with spawn() to prevent command injection * docs: add audit grade enforcement policy (D/F = mandatory rework) Grade D or F requires reverting and redoing work from scratch with strict TDD. No code reuse — the process drives the implementation, not the other way around. Speculative tests (writing tests after code) are not TDD. * Revert "feat(compiler): eliminate .value from public API — auto-unwrap signal properties (#269)" This reverts commit 70b1532. * chore: add changeset for shell injection fix * audit: PR #277 (vertz-tech-lead) - Grade C Audited merged PR #277: fix: resolve lint errors + update pre-push hooks for Turborepo Grade: C - Work is necessary and correct but has significant process violations Key findings: - ❌ Scope violation: Bundles 18 audit files with infrastructure fixes - ❌ No ticket for this work -⚠️ Audit worktree isolation not used - ✅ Fixes real problem (release workflow failures) - ✅ Improves quality gates (now runs tests via Turborepo) Violations: 2 major (scope bundling, no ticket), 2 minor Files reviewed: 28 (+5002, -64) Merged: 2026-02-14T17:27:02Z * fix(demo-toolkit): validate AudioClip paths before FFmpeg check The security validation for AudioClip paths must run before the hasFFmpeg check to ensure shell injection protection (CWE-78) is enforced even when FFmpeg is not available (e.g., in CI environment). This fixes the failing test: 'should reject malicious AudioClip path in createAudioTimeline' --------- Co-authored-by: auditor <auditor@vertz.dev> * revert: signal auto-unwrap (PR #269) — Grade D audit, mandatory TDD redo (#280) * fix(demo-toolkit): replace shell interpolation with spawn() to prevent command injection * docs: add audit grade enforcement policy (D/F = mandatory rework) Grade D or F requires reverting and redoing work from scratch with strict TDD. No code reuse — the process drives the implementation, not the other way around. Speculative tests (writing tests after code) are not TDD. * Revert "feat(compiler): eliminate .value from public API — auto-unwrap signal properties (#269)" This reverts commit 70b1532. * chore: add changeset for shell injection fix * audit: PR #277 (vertz-tech-lead) - Grade C Audited merged PR #277: fix: resolve lint errors + update pre-push hooks for Turborepo Grade: C - Work is necessary and correct but has significant process violations Key findings: - ❌ Scope violation: Bundles 18 audit files with infrastructure fixes - ❌ No ticket for this work -⚠️ Audit worktree isolation not used - ✅ Fixes real problem (release workflow failures) - ✅ Improves quality gates (now runs tests via Turborepo) Violations: 2 major (scope bundling, no ticket), 2 minor Files reviewed: 28 (+5002, -64) Merged: 2026-02-14T17:27:02Z * fix(demo-toolkit): validate AudioClip paths before FFmpeg check The security validation for AudioClip paths must run before the hasFFmpeg check to ensure shell injection protection (CWE-78) is enforced even when FFmpeg is not available (e.g., in CI environment). This fixes the failing test: 'should reject malicious AudioClip path in createAudioTimeline' --------- Co-authored-by: auditor <auditor@vertz.dev> * chore(demo-toolkit): remove package, moved to backstage (#289) * docs: add package naming strategy analysis Analysis covering: - Problems with current @vertz/core and createApp naming - Naming alternatives with pros/cons - Multi-service DX scenarios - Framework comparison - Recommendation: @vertz/server + createServer() Josh (Developer Advocate) * chore(demo-toolkit): remove package, moved to backstage repo * chore: update lockfile after removing demo-toolkit --------- Co-authored-by: Vertz Auditor <auditor@vertz.dev> Co-authored-by: vertz-devops[bot] <2832183+vertz-devops[bot]@users.noreply.github.com> * docs(design): propose revised positioning messaging --------- Co-authored-by: vertz-dev-core[bot] <260431274+vertz-dev-core[bot]@users.noreply.github.com> Co-authored-by: vertz-dev-core[bot] <2828081+vertz-dev-core[bot]@users.noreply.github.com> Co-authored-by: vertz-dev-dx[bot] <2828112+vertz-dev-dx[bot]@users.noreply.github.com> Co-authored-by: kai <kai@vertz.dev> Co-authored-by: vertz-dev-dx[bot] <260432280+vertz-dev-dx[bot]@users.noreply.github.com> Co-authored-by: vertz-tech-lead[bot] <260431879+vertz-tech-lead[bot]@users.noreply.github.com> Co-authored-by: auditor <auditor@vertz.dev> Co-authored-by: vertz-devops[bot] <260554958+vertz-devops[bot]@users.noreply.github.com> Co-authored-by: vertz-devops[bot] <2832183+vertz-devops[bot]@users.noreply.github.com> Co-authored-by: vertz-tech-lead[bot] <vertz-tech-lead[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #351