The scenario reads "an account not connected to another does not read its
protected ENTITY, then reads it after connecting", but the probe was reading
`did🆖${protected_store_id}` — the STORE document — and writing its test
entities straight into it.
Under an ACL that shortcut was harmless. Under key possession it is wrong, and
for a reason the model states outright: sharing a store capability would hand
over everything the store contains, present and future. The unit of sharing is
the document. `declareConnections` therefore shares the keys of entity
documents, the store is not one of them, and the reader legitimately saw
nothing. The code was right; the probe was standing in the store for an entity.
Writing several entities into a store-level document also broke this repo's own
one-document-per-entity rule.
The probe now creates a real protected entity document, writes the entity there,
and mounts its subscription on THAT document.
A second defect surfaced while fixing the first: `connect()` asserted both
directions from the READER's session, but a capability can only be shared by
whoever holds it, and `capFor` answers for the connected identity alone — so the
owner-side call returned early having shared nothing. Each direction is now
asserted from its own session, and the reader drains its inbox afterwards.
The reader is a genuine second identity (per-run identifiers give it its own
account, stores, inbox and keyring), not the same one in disguise — a test that
passes because the state is unreal proves nothing. Checked by breaking it on
purpose: without `connect` it fails with `expected +0 to equal 1`.
Also recorded, and worth knowing before writing another probe: `resetCaps()`
clears the "a capability was issued" flag, which disarms the read filter
entirely — it has to run BEFORE the first mint, or reads go straight through and
the reader sees everything.
tsc 0, @ui 7/7, target scenario green, read-filter not regressed.
The SDK was rebuilt: reading is possession instead of an ACL, `Nuri` and
`ReadCap` are template literal types, the cross-account fan-out is gone, and so
is the global discovery index.
Repair the typecheck gate FIRST — it was checking nothing. Under TypeScript 6 the
deprecated `baseUrl` is reported as an ERROR that aborts compilation, so
`tsc --noEmit` exited 0 having verified nothing, behind a single line that reads
like a harmless warning. Dropping `baseUrl` (paths resolve relative to the file
since 4.4) makes the gate real again — and it immediately surfaced 33 errors,
three of which had been dormant for a long time.
Types: 18 sites fixed AT THE SOURCE — the functions that produce a NURI now
return `Nuri` — with `isNuri` guards only at genuine boundaries (an `@id` read
back from a document, an argument coming from a Cucumber step). No cast, no
`@ts-ignore`: silencing the compiler here would have removed the very guarantee
the new types provide.
Capabilities: the ACL is gone. `grantRead`/`protectedDocsOf`/`canRead`/
`makePublic` give way to `capFor`/`shareCap`/`publishRepoLink`, and `open` loses
its `owner` argument. `declareConnections` now shares the caps of its OWN
protected documents to each neighbour's wallet inbox.
Discovery is REMOVED, not postponed: there is no discovery in the target model,
a reader reaches a document only by following a link it was given. The module and
its call sites are gone; the scenario is suspended with a comment saying what
will bring it back — a Festipod DIRECTORY document, whose link the app knows.
Kept rather than deleted: the product need has not gone away.
Verification, and a correction to how it was measured. The @data baseline (20/22)
had been taken on a bloated test wallet: 93 MB against a threshold documented
around 99 MB, with the run stretching from 18 to 23 minutes. Restarting from a
fresh profile drops it to 9m37 and turns BOTH baseline failures green — including
the cold-reconnection one, which confirms the SDK's claim that a fresh session
reads its own documents back with nothing re-declared. So the reference itself was
degraded, on both sides of the comparison.
Real state: typecheck 0, @ui 7/7, @data 20/21. The single failure is understood
and left standing: the protected-connections probe reads the protected STORE
document as a stand-in for an entity. Sharing a store cap would hand over its
entire contents, present and future — precisely the gesture the model refuses. The
scenario's own title says "the protected ENTITY"; the probe is what took the
shortcut, and it is what has to change.
The @ng-org/* SDK alpha versions are now published on npm. Switch the
package.json dependencies from .ng-tarballs/*.tgz paths to npm
versions, removing the need for a sibling nextgraph-rs build to
install the project. Makes containerized deploys (Coolify) trivial.
- @ng-org/alien-deepsignals: 0.1.2-alpha.11 (unchanged)
- @ng-org/orm: 0.1.2-alpha.15 → 0.1.2-alpha.18
- @ng-org/shex-orm: 0.1.2-alpha.7 → 0.1.2-alpha.8
- @ng-org/web: 0.1.2-alpha.11 → 0.1.2-alpha.13
scripts/build-ng-packages.sh and the .ng-tarballs/ workflow remain
available for local development against an unreleased nextgraph-rs
build (`.gitignore` keeps the directory ignored).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Port modern clean theme (DM Sans, orange accent, app-* CSS classes)
and screen redesigns from festipod-mockups; replace sketchy Ubuntu
theme. New shared components: BottomNav, EventCover, EventMeetingPoints,
Toast, AvatarStack, Tag, RelevanceIcon.
- Restructure from prototyping shell to real mobile web app:
path-based routing (History API), Gallery/DemoMode/PhoneFrame removed,
Storybook setup for screen/component browsing.
- ConnectScreen ported from mockup (QR-based user connection); routed
at /profile/connect, wired from FriendsListScreen.
- Dev-only auto-seed of NG wallet when empty
(gated on NODE_ENV !== 'production'); bootstrapWallet already
self-checks for non-empty ngSet so safe even in race conditions.
- Render-based @ui test infrastructure: happy-dom + LocalDataProvider +
RouterProvider via src/shared/test-harness/renderHelper.tsx, exposed
on the world as renderedDoc. world.hasText/hasField/hasElement prefer
the rendered DOM and fall back to source for backward compatibility.
- Migrate 25 brittle @ui assertions from regex-on-source to DOM
queries; delete implementation-detail tests (showDuplicateWarning,
importableEvents, importedFrom — anti-patterns per the new contract).
Update feature files where the UI changed: "Mes amis" → "Mon réseau",
"Mes événements à venir" → "À venir" on home, Thématique removed
from create-event wizard, etc.
- Path-based @e2e steps (pushState + popstate dispatch) replacing the
legacy "#/demo/…" hash routing tied to the deleted Gallery.
- Add .project/knowledge/test-layer-contracts.md defining the role of
each test layer (@ui = display with seed data + DOM, @data = mutations
through NG broker, @e2e = critical user journeys) with anti-patterns
and migration consequences.
Test status: 75 passed / 71 skipped (explicit "non implémenté")
/ 2 failed (pre-existing @wip on ngSet.delete() NG ORM limitation).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add @e2e test layer: real app in broker iframe via Playwright
- Fix broker redirect: conditional auto-init only when inside iframe
- Fix seed data flash: empty data during 'connecting' phase
- Fix Gallery button in iframe: explicit navigate instead of history.back
- Add auth e2e feature scenarios and step definitions
- Update docs: bdd-testing, data-layer-testing, data-layer, AGENTS.md
- Add decision record for conditional NG init approach
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Rename steps/frontend/ to steps/ui/ across all modules and shared
- Add data-layer test harness (mock + real broker modes) with Playwright
- Add inscription data-layer steps (@data scenarios)
- Add test auth setup script and browser debug script
- Update docs (architecture, BDD testing, data-layer testing)
- Add ADR for headless wallet creation decision
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add NextGraph data layer with @ng-org/orm, SHEX shapes (Event, UserProfile,
Participation), session management, and FestipodDataContext with dual-mode
operation (connected via NextGraph or local seed data)
- Add BrokerBanner and NgStatus components showing connection status
- Refactor to feature-based architecture: organize code by business domain
(event, user, home, auth, workshop, meeting, notification) instead of
technical layer. Modules only import from shared/, never from each other
- Collocate BDD features and step definitions with their modules: event-specific
steps in event/steps/, user steps in user/steps/, shared generic steps remain
in shared/steps/
- Set up multi-layer BDD structure (frontend/backend/e2e steps per module)
- Add project documentation (AGENTS.md, .project/knowledge/)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- EventDetailScreen: person who shared the event is now "Relayé par"
- ProfileScreen/UserProfileScreen: remove role badges from event lists
- FriendsListScreen: Organisateur/Organisatrice → Relayeur/Relayeuse
- Update event data to transition-themed examples
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace @skip tag + placeholder step with just placeholder step.
Skipped scenarios now only need:
Scénario: Name
* Scénario non implémenté
- Remove @skip tags from all 26 feature files
- Add step definition returning 'skipped' for placeholder
- Update GherkinHighlighter to hide placeholder and make
skipped scenarios non-expandable (no chevron, no click)
- Update documentation with new format
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add screenIds extraction to parse-features.ts based on step patterns
- Update ParsedFeature type to include screenIds field
- Remove manual screenIds from user story definitions in index.ts
- Compute screenIds by looking up parsed features at runtime
Feature files are now the single source of truth for screen-to-story
linking. Run `bun run features:parse` to update after modifying features.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace abstraction functions with inline regex patterns in step definitions
- Add clear test outcomes: Pass/Fail for testable features, Pending with
specific prefixes (NOT IMPLEMENTED, CANNOT TEST, WRONG STEP, NOT ON THIS
SCREEN) for non-testable features
- Fix GherkinHighlighter to use step.text instead of step.originalLine
for step definition matching
- Update documentation with Test Outcomes section
- Extend test:cucumber script to run all parsing steps
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sylvain Duchesne