Add one-way Skill governance and personal reports #12

2026-08-06T13:01:52+08:00

jesse commented

2026-08-06 13:01:52 +08:00

Summary

enforce one-way snapshot import from the local read-only yinduzhanxing source and preserve semantic-merge boundaries
merge the upstream reader-report contract without removing commercial themes
add strict ReportDocument v1 JSON Schema/Zod/Python validation and additive self-hosted/Supabase migrations
generate grounded personal reports through the real consultation workflow and Mastra structured output with owner isolation, idempotency, rate limits, stable failure codes, and canonical revalidation
add owner-only report reader, real D1 SVG, evidence appendix, browser print-to-PDF, and a gated homepage CTA
add staging feature selectors, acceptance matrix, resource checks, and additive rollback runbook

Security boundaries

no source Skill write-back; source commit remains unknown and is represented by a reproducible tree SHA-256
no arbitrary HTML/CSS/JS or server-side PDF browser runtime
no mock/sample/random chart fallback
report API uses authenticated reads and service-role generation writes; ready documents are revalidated before delivery
report body, birth facts, prompts, tokens, and raw exception stacks are excluded from logs
production deployment/migration is not authorized

Verification

python3 scripts/pre_work_check.py --remote-timeout 8 --command-timeout 45: pass
personal report frontend focused suite: 142/142
core Python matrix: 87/87
TypeScript: pass
Next production build: pass; NFT whole-project warnings 0
ESLint: 0 errors, 4 pre-existing unrelated warnings
full frontend suite on this macOS host: 1396/1409 after the new tests; remaining 13 are environment-command failures (Docker CLI absent, bare python absent, and their dependent assertions). The staging quality gate must rerun in its complete runner environment.

Rollback

application target: 49da8f916960030d5760d8dedf4e77820732a527, subject to retained successful gate artifacts
personal_reports migration is additive and intentionally remains after application rollback
see docs/operations/personal-report-staging.md

## Summary - enforce one-way snapshot import from the local read-only yinduzhanxing source and preserve semantic-merge boundaries - merge the upstream reader-report contract without removing commercial themes - add strict ReportDocument v1 JSON Schema/Zod/Python validation and additive self-hosted/Supabase migrations - generate grounded personal reports through the real consultation workflow and Mastra structured output with owner isolation, idempotency, rate limits, stable failure codes, and canonical revalidation - add owner-only report reader, real D1 SVG, evidence appendix, browser print-to-PDF, and a gated homepage CTA - add staging feature selectors, acceptance matrix, resource checks, and additive rollback runbook ## Security boundaries - no source Skill write-back; source commit remains unknown and is represented by a reproducible tree SHA-256 - no arbitrary HTML/CSS/JS or server-side PDF browser runtime - no mock/sample/random chart fallback - report API uses authenticated reads and service-role generation writes; ready documents are revalidated before delivery - report body, birth facts, prompts, tokens, and raw exception stacks are excluded from logs - production deployment/migration is not authorized ## Verification - `python3 scripts/pre_work_check.py --remote-timeout 8 --command-timeout 45`: pass - personal report frontend focused suite: 142/142 - core Python matrix: 87/87 - TypeScript: pass - Next production build: pass; NFT whole-project warnings 0 - ESLint: 0 errors, 4 pre-existing unrelated warnings - full frontend suite on this macOS host: 1396/1409 after the new tests; remaining 13 are environment-command failures (Docker CLI absent, bare `python` absent, and their dependent assertions). The staging quality gate must rerun in its complete runner environment. ## Rollback - application target: `49da8f916960030d5760d8dedf4e77820732a527`, subject to retained successful gate artifacts - personal_reports migration is additive and intentionally remains after application rollback - see `docs/operations/personal-report-staging.md`

jesse added 6 commits 2026-08-06 13:01:58 +08:00

feat(sync): enforce one-way yinduzhanxing import policy 685ed00e2f

feat(skill): merge upstream reader-report contract 03d3b58ff7

feat(report): add personal report contract and persistence 82dab96b07

feat(report): generate grounded reports with Mastra 47e829e971

feat(report): add browser-rendered report and PDF print d89073d296

docs(staging): add personal report acceptance and rollback runbook

Staging Backend Quality Gate / validate (pull_request) Failing after 15m33s

Details

Staging Backend Quality Gate / publish (pull_request) Has been skipped

Details

c949b224fe