From 9b8c5f74164036e92fe8502623a58f346da18eac Mon Sep 17 00:00:00 2001 From: Danijel Martinek Date: Mon, 13 Jul 2026 06:15:09 +0200 Subject: [PATCH] docs(template): record the 2026-07-13 audit-fix sync in provenance Note that the branch is now maintained (grown beyond the snapshot) and enumerate the six ported clusters, including the auth-only reductions of core-cms and web-next. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK --- TEMPLATE.md | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/TEMPLATE.md b/TEMPLATE.md index 79a02fb..211a035 100644 --- a/TEMPLATE.md +++ b/TEMPLATE.md @@ -67,6 +67,44 @@ release-please config as the template default (hybrid per-feature versioning is a documented alternative — see ADR-021, `docs/guides/releasing.md`, and the pre-retrofit config in the source repo's git history). +## Audit-fix sync — 2026-07-13 + +This branch is now a maintained template branch (it has grown beyond the +original 2-commit snapshot). On 2026-07-13 the applicable subset of the +upstream template audit-fix effort was ported here, adapted to the +clean-slate auth-only shape. Six coherent commits landed on top of the +snapshot: + +- **chore(tooling)** — root playwright config in `test:visual`, pruned dead + `VERCEL_ENV` from `turbo.json`, single Chromium install in CI, a dedicated + `vitest.scripts.config.mjs` + `pnpm test:scripts` runner for `scripts/` + (node:test → vitest), repo-wide `*.tsbuildinfo` gitignore + untrack, and + every `@trpc/*` range aligned on `^11.18.0`. +- **fix(compliance)** — DSR caller-scoping + audit-trail exports, consent + allow-list/merge/superjson, core-audit keyed 128-bit pseudonyms + + audit-logs collection + GDPR erasure hook, core-shared retention-purge + (task + tombstone + boot registration) and the `require-authenticated` + tRPC helper. **core-cms was reduced to the auth-only collection set** + (users + audit-logs; the users+workspaces shape from the product fork does + not apply — there is no workspaces feature here). +- **fix(auth)** — server-side jti session-revocation denylist, + constant-time signature compare, server-derived `clientIp` (dropped from + the public sign-in schema), crypto-path tests, and the users DSR pii map. +- **refactor(core-trpc)** — removed the illegal `core-trpc → core-api` + edge; the context + providers are now `AnyTRPCRouter`-generic. +- **feat(web-next)** — per-request `createWebNextTrpcContext` (server user + resolution + live consent/dsr bindings), compliance bindings in + `bind-production`, and manifest-seeded `InMemoryRateLimit` on the + production path. **Reduced to the auth-only shell** — no workspaces + binder, no product discovery/runner provisioning. +- **test(coverage)** — cover-the-diff repairs for the ported auth router + + core-dsr export, plus mirrored coverage-diff excludes. + +The four upstream demo-feature fixes (blog/media/marketing-pages/navigation) +were skipped — those features do not exist on this branch. No product code +or naming was introduced; the sole intentional occurrence of the source +product's name remains this provenance note. + ## How to start a project from this branch ```bash