Ports the upstream compliance-core audit fixes onto the kept core-dsr,
core-consent, core-audit, core-cms and core-shared packages (pristine
template state here, so taken to the fixed end-state):
- core-dsr: scope DSR operations to the caller's own subject (A11);
include the subject's audit trail in exports; resolve the per-request
binding from ctx instead of a throwing singleton proxy.
- core-consent: build the consent router from the shared superjson
transformer (A10); merge per-category on persist instead of replacing;
validate migrated categories against an allow-list.
- core-audit: keyed 128-bit pseudonyms + salted DSR certificate; add the
audit-logs collection and the req-scoped GDPR audit-erasure afterDelete
hook (A6).
- core-shared: grace-purge soft-deleted rows via a retention-purge task +
tombstone field and boot registration (A2/A3); add the
require-authenticated tRPC helper; derive clientIp + resolve the session
user in createTrpcContext (B2/A11).
- core-cms: register audit-logs, wire the audit-erasure hook and
retention-purge tasks; adapted to our collection set (users, workspaces).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
Reconciles the upstream audit-fix PR's infra changes onto the Veect
control-plane fork (kept-file portions only; deleted demo features
skipped):
- resolve the root playwright config in pnpm test:visual (S8)
- prune dead VERCEL_ENV from turbo.json globalEnv (S9)
- drop the duplicate chromium install in the storybook CI job (S10)
- wire scripts/**/*.test.mjs under a dedicated vitest runner
(vitest.scripts.config.mjs + pnpm test:scripts + CI validate step);
convert node:test imports to vitest keeping node:assert; fix the
work-tree fixtures to mirror the docs/work/epics/ layout
- ignore *.tsbuildinfo repo-wide and untrack the committed build state
- align every @trpc/* range on ^11.18.0 so the workspace resolves to a
single version (peer-warning-free install)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
The template baseline shipped 9 packages without @vitest/coverage-v8
and documented an L0 invocation turbo cannot parse — the full coverage
sweep had never run. Adds the provider (pinned to the feature-package
spec), a root test:coverage script, corrects every live doc/prompt/CI
occurrence, and calibrates coverage excludes for the 4 packages whose
latent threshold failures the outage masked (framework glue only —
zero threshold numbers changed). L0 sweep now passes 21/21.
Squash of a284baa + 5c6af95 (worktree-agent-a013c67cea83b2636),
implemented and reviewed via the dispatch loop under the epic's
baseline waiver (lint pending story 03).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
