fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(work): close walking-skeleton story 03 (workspaces feature)

Browse Source
This commit is contained in:
Danijel Martinek
2026-07-12 22:37:40 +02:00
parent eec402d49d
commit 11e5012572
2 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/work/epics/walking-skeleton/03-workspaces-feature-core/_story.md
View File

@@ -3,7 +3,7 @@ id: 03-workspaces-feature-core
epic: walking-skeleton
title: workspaces feature core — connect, status, list + encrypted credential storage
type: user-story
status: todo
status: done
feature: workspaces
depends-on: []
blocks:
@@ -13,6 +13,7 @@ blocks:
10-web-next-wiring,
]
created: 2026-07-12T10:24:14Z
updated: 2026-07-12T20:37:41.484Z
---
## Goal
@@ -50,7 +51,9 @@ The workspace is the root entity of the entire skeleton: provisioning (story 06)
## Tasks
- [ ] Run `pnpm turbo gen feature workspaces` → green feature scaffold (manifest, contracts, binders, controllers, tests, dev-seed).
- [ ] Add `connectWorkspace` use case — manifest entry (`mutates: true`, `audits: ["workspace-connected"]`), input schema (name + git URL + PAT), output schema (credential never included), red test → green impl, DI wiring with audit emission, tRPC procedure.
- [ ] Add the Workspaces Payload collection + real repository: PAT encrypted AES-256-GCM with a scrypt-derived key from `VEECT_SECRET`, write-only field (Payload API never returns it); repository contract suite covering mock + Payload impls incl. the write-only credential behavior.
- [ ] Add `getWorkspaceStatus` and `listWorkspaces` use cases — manifest entries, contracts, red tests → green impls, DI wiring, tRPC procedures — returning persisted workspace/runner status.
- [x] Run `pnpm turbo gen feature workspaces` → green feature scaffold (manifest, contracts, binders, controllers, tests, dev-seed).
- [x] Add `connectWorkspace` use case — manifest entry (`mutates: true`, `audits: ["workspace-connected"]`), input schema (name + git URL + PAT), output schema (credential never included), red test → green impl, DI wiring with audit emission, tRPC procedure.
- [x] Add the Workspaces Payload collection + real repository: PAT encrypted AES-256-GCM with a scrypt-derived key from `VEECT_SECRET`, write-only field (Payload API never returns it); repository contract suite covering mock + Payload impls incl. the write-only credential behavior.
- [x] Add `getWorkspaceStatus` and `listWorkspaces` use cases — manifest entries, contracts, red tests → green impls, DI wiring, tRPC procedures — returning persisted workspace/runner status.
_Landed: 6216897 + 8219c1f + c990e1b + eec402d (cherry-picks of the four slices), adversarial-reviewer-approved: single decrypt path verified through every export chain, leaky-repo strip test genuine, tamper/wrong-secret/salt-uniqueness covered. Non-blocking follow-ups: (1) isEncryptedCredential v1:-prefix idempotency guard could theoretically store a colon-crafted PAT as plaintext (read-denied on all paths, no leak — future hardening); (2) implementer's claimed @trpc/server repo-wide pin was NOT actually in the diff (alignment achieved via ^11.0.0 resolution; no regression)._