develop's 11 unique commits are fully superseded by main (audited):
cve patch versions already present in main's lock, dep bumps
superseded or obsolete, GrcpR envelope removed. this ours-merge
records develop's history while taking main's tree wholesale.
five drivers carried private bytesToHex copies and three carried
hexToBytes variants, while mbus/dlt645 frames each implemented the same
sum checksum:
- codecutil.bytesToHex now uses hexformat uppercase, matching what all
five private copies already emitted (zero display change)
- codecutil.hexToBytes added: whitespace-tolerant, blank-to-empty,
mixed-case input
- codecutil.sumChecksum added as the shared mbus/dlt645 frame checksum
and both frame classes delegate to it
- dlt645's inline hex loop replaced by codecutil.hexTobytes
- fins' private bcd copy kept deliberately: codecutil's bcd variant
strips leading zeros, a different protocol semantic
gitattributes only covered five file types; on a windows clone
(core.autocrlf=true) every other text file checks out as crlf, which
spotless's origin/main ratchet then treats as whole-repo changes and
the format gate fails everywhere. declare lf as the repository-wide
text convention with explicit crlf exceptions for bat/cmd/ps1, mark
the binary asset families, and renormalize (no content changes - the
tree was already lf)
- springdoc: declare api-docs/swagger-ui enabled explicitly; the boot
reminder only fires on unset properties, so the intent-declaring
values keep behavior identical and quiet all six services
- netty: add the macos dns native resolver to the gateway so the
resolver does not log an error at boot on mac dev machines (the
no-classifier jar bundles every arch and is inert on linux)
- hibernate-validator HV000271: spring-cloud-gateway 4.3.0 still uses
container-level @Valid on its List properties. logger-level rules
cannot suppress it because spring boot's logging re-init installs a
second loggercontext that resets them, so drop the exact message
with a turbo filter attached to every context loading this config;
the class documents the upstream trigger for removal
live verification: five services plus gateway boot with zero warn and
zero error lines, virtual driver included; salt/login probe 200
the husky shim routes commit-msg to .husky/commit-msg, which did not
exist - the documented subject-line rules (type whitelist, optional
scope, lowercase imperative english description of 10-100 chars) were
never machine-enforced; add the missing hook so bad subjects fail the
commit while merges/reverts/fixups pass through
services resolve dc3/data against the process cwd, so a driver started
from its module directory writes dc3-driver/<module>/dc3/data/... that
the root-anchored dc3/data/ pattern never matched; use **/dc3/data/
(any depth) and add the sqlite -shm/-wal/-journal sidecars that *.db
alone does not cover
sweep every module to satisfy the new method-name rule, renaming
about 40 methods together with their interface, implementation, test
and cli call sites: store find() lookups become get(), analytics
queryLatest/queryHistory become getLatest/getHistory, sql helper
query() becomes spec()/sql(), jwks fetch() becomes load(), and the
cursor record component queryDigest becomes requestDigest
no behavior changes; full unit suite (5278 tests) and both quality
gates stay green
upgrade checkstyle from a naming-only ruleset to a public-api gate:
- unusedimports: dead imports fail the build (zero violations existed
at adoption)
- missingjavadoctype/method: public types and members must carry
javadoc (scope public, @override exempt) - about 140 doc comments
were added across records, filters, stores and gRPC servers
- method name format now rejects find/query/fetch prefixes, encoding
the repo crud verb law (select stays reserved for mybatis mappers
and is policed by review)
- suppressions: skip protobuf generated-sources, which only enter the
scan in full-reactor builds
- spotless: ratchet checks to origin/main so legacy formatting debt
stops blocking unrelated changes and CI formats only what changed
reactiveloadbalancer is intentionally absent from the gateway; loading
the no-load-balancer-client autoconfiguration only emits a
typenotpresent introspection warning at boot
the repo-wide reformat mangled every go template directive in the
chart ({{ }} split to { { } }, {{- to {{ -, headers indented into the
yaml, ports list items misaligned under conditional blocks), leaving
the chart unrenderable since it landed; restore the directives, align
the conditional grpc/https port entries with the http entry, and drop
the stray blank lines - helm lint now passes and the full chart
renders 66 resources with both default and production values
the historical defaults dc3.security.key.2026.io.github.pnoker and
io.github.pnoker.dc3 are public in this repository, so any deployment
that never overrode them shipped a known hmac signing key
- app/scale/swarm compose: fail fast (${var:?}) when dc3_security_key
or auth_hmac_secret is unset; dev compose keeps a clearly-marked
dev-only default
- helm production/default values and k8s secret.env ship empty values:
pre/pro startup rejects blank and known-default hmac keys, forcing
--set-string or an existingsecret; document the per-key failure mode
honestly instead of overpromising startup rejection for both
- dev env files: rotate both keys to machine-generated dev-only values
and add throwaway rs256 material for local oauth flows
- fix the chart maintainer email to a syntactically valid address
a live-stack sweep of all 36 drivers surfaced five sdk-level defects
that left reads dead or the whole fleet unbootable:
- drop the empty spring.main stub in the shared driver profile; the
boot 4.1 binder rejects null-valued keys and every driver died at
startup with a bind exception
- rename the schedule enable flag to enable to match what every driver
application.yml actually spells; with the old enabled key the read
and custom quartz jobs were silently never scheduled
- treat proto3 zero-versions as unset when reconciling registration
so a driver restart re-registers instead of failing the optimistic
lock with 'driver version conflict'
- ignore the driver's own registration event that can be consumed
before applymetadata finishes instead of logging an error
- initialize jdbc/serial connection maps eagerly: the registration
event handler invalidates pools and nped on a lazy-null map
- ble: exclude the guava 18 pin dragged in by bluetooth-manager
- kafka: use the starter (boot 4 split autoconfigurations out of the
bare jar) and read the compose-provided bootstrap variable
- lwm2m: pin californium to the 3.x api leshan m14 needs and
configure an explicit coap endpoint
- mqtt: replace the orphaned spring-integration gateway with a paho
publisher so the send path exists again
- boot sweep result: 36/36 drivers start, 0 errors
the client_credentials grant could never complete: the authorization
insert left principal_type null, state/code/refresh columns were
declared not null for a grant that never sets them, and the connection
grant type silently fell back to authorization_code because builders
match on the enum value, not the name
- stamp the service-account principal type on the cc authorization
- bind explicit nulls for grant-specific columns in insertauthorization
- make state_hash, authorization_code_hash and the refresh hashes
nullable in seed ddl and resync the embedded schema fingerprint
the /api/v3/auth/token/** wildcard also routed check and cancel
without the authentic filter, so those @PreAuthorize endpoints could
never establish a caller identity and always returned 401 (the logout
denylist never fired); enumerate salt, generate and change_password
explicitly and let the rest fall through to the authenticated route
- method-level @PreAuthorize rejections propagated to the generic
handler and returned http 500; add an access-denied mapping so
permission failures read as 403 problem details
- actuator: only /actuator/health stays public, the rest require
authentication in pre/pro (dev keeps prometheus open for local
scraping); document why csrf is safely disabled
- centers: exclude the grpc oauth2 resource-server autoconfiguration
per service (not in the shared web profile, which outranks the
gateway's own excludes) and add the resource-server/jose deps so
annotation introspection resolves cleanly at boot
token/cancel accepted any name+tenant pair, so a principal holding
token:delete could log out arbitrary users; compare the resolved
credential against the caller principal and deny otherwise
role_principal_bind:add alone could attach the wildcard administrator
role to any principal, and role_resource_bind:add could attach the
wildcard resource to a held role; require the caller to already hold
the granted role/resource code or the wildcard authority before the
insert proceeds (permission resolution goes through the same
authpermissionprovider used by @perm.can)
the public token/change_password endpoint verified the current
password but never recorded failed attempts, leaving it a brute-force
surface the login endpoint does not have; route wrong-password
attempts through recordFailed so the existing lockout applies
the compact constructors rejected a null tenantId during jackson
deserialization, so any authenticated request body with filters failed
with http 400 before withTenant could inject the caller tenant; keep
only the page-bounds validation at parse time
the command/event detail drawers render tenantId but the vos never
returned it; add a server-resolved read-only field (inbound binding
stays ignored by the existing mapstruct mapping) and refresh the
openapi-manager snapshot
- command_history/get_by_record_id now binds the declared wire name
record_id instead of the raw parameter name recordId, matching the
event_history twin and the frontend/CLI clients
- point_command_history/get_by_command_id likewise binds command_id,
and the accepted statusUri built by point_command write now uses it
- openapi-data snapshot updated for both query params
- cli command history and web mock handlers aligned to the same names
- web mock registers command_history under the data service prefix
AGENTS.md stays lean with always-relevant rules and a task routing
table; the deep per-area conventions move to
dc3/agents/{backend,frontend,cli,testing}.md to be read on demand.
CONTRIBUTING.md documents the changelog-only commit rule and the
generated-CHANGE.md editing policy.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Land the v7 three-terminal UX decision: drop the width/pointer-based
44px touch enlargement so one 32px density holds across desktop,
tablet, and mobile, and rebuild entity pages on a responsive record
list (ResponsiveRecordList + EntityMobileCard + per-entity mobile
summaries). Tighten the nginx security headers (CSP frame-ancestors
'none', X-Frame-Options DENY) to match the static e2e server.
Complete the dc3-web audit remediation, including the remaining LOW
items from docs/dc3-web-low-defects-handoff.md: streaming-safe
message loads in the agentic store, mock menu reparent cycle
rejection, paged-list page clamping, fetch/axios mock request
normalization, per-table attribute catalogs, post-flush alarm
watchers, rowKey-agnostic delete state, localized card text
fallbacks, and e2e-server port fail-fast.
Gate: vue-tsc, eslint, vitest 687 passed, responsive e2e 64 passed.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Replace the Particles canvas with LoginAtmosphere, the warped interactive
grid + logo-dot silhouette shared with the dc3.site family sites, and add
an AGPL copyright footer with the platform tagline. Drop the 48px grid
overlay from the login background so the atmosphere carries the scene.
develop is no longer the integration target (main is the only active
line). Route all four ecosystems to main so updates are proposed against
the active branch; the develop branch is kept as an archive.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Backfill the one-line Javadoc required by check_documentation on public
top-level types and non-override public methods (1305 sites across 313
files), matching the existing single-line contract style: each doc states
the behaviour contract without @param/@return tags.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Add README files for the four dc3-db-postgres-* modules, state the
artifactId in the r2dbc module READMEs, list the new modules in the
dc3-db README, and document the CallTool RPC in dc3-api-auth.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The type-level Javadoc check walked annotations line by line and stopped
inside multiline annotation arguments, reporting false negatives such as
AuthInitRunner. Reuse the bracket-aware _annotation_block_start helper so
Javadoc attached above a multiline annotation block is recognized.
Co-Authored-By: Claude Code <noreply@anthropic.com>
7fde11134 moved the R2dbc store adapters into per-domain postgres modules
but left the tck suite importing them from dc3-common, breaking test
compilation. Add the four module dependencies and update the imports.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The config file only carried two paths-ignore entries, which the init action accepts directly as inputs; folding them into codeql.yml removes the separate .github/codeql directory without behavior change.
Add Dockerfiles under dc3/dependencies for MariaDB and MySQL that layer on the dc3-mariadb-base/dc3-mysql-base images published by dc3-docker (2026.6), matching the dc3-postgres layering convention. Nothing is layered yet since DC3 runs on the PostgreSQL dialect; credentials, seeds, and entrypoint overrides land here when a MariaDB/MySQL profile is needed.
Serve the dc3-web image over plain HTTP on port 80 only: remove the ssl_certificate/ssl_certificate_key directives, the 443 listeners and the HSTS header from default.conf, drop the 8443:443 mapping and the certificate COPY from the Dockerfile, and remove the acme.sh README. The retired dc3.site certificate is preserved as reference material at nginx/certs/ssl-certs.md.
Join 1242 keyword-split statement lines (COMMENT/CREATE/ALTER/LOAD), move the dc3_identity_audit_log table section and the schema fingerprint INSERT so every script orders DDL before seed data, and drop one duplicated COMMENT ON COLUMN. Statement multiset verified identical apart from the intended dedup. The canonical fingerprint changes to e81e3562... and is synchronized via schema_fingerprint.py --sync into the embedded ddl_hash and all four distribution points; existing initialized databases require re-initialization (flag day).
Relocate all 64 R2dbc*Store implementations from dc3-common-{auth,manager,data,agentic} repositories into new dc3-db-postgres-{auth,manager,data,agentic} adapter modules (package io.github.pnoker.db.postgres.<domain>), each registered through its own AutoConfiguration. Reactive*Store ports and filter types stay in the business modules; services are untouched. Drops stale MyBatis wording from AGENTS.md and init runner javadoc.
Henry Zhang