5 Commits

Include renames

Author	SHA1	Message	Date
ducoterra	1fe932cf39	phase: 05_update_projects_section ... **Phase 05 final pass — all 4 tasks already complete; verified phase-level criteria + docs. Repo 100% green.** - Verified: 6 `project-card fade-in` cards; order Brain of Reese → Reverse Proxy → Dynamic DNS → Local AI Stack → Deployment Automation → ServWaf; `src/index.html` diff hunks (lines 293–538) all inside `#projects` (286–542). - `./build.sh` → `Build complete: dist/` (exit 0); `npm test` → **48 passed, 0 failed**; `bash .agents/validate.sh` → **exit 0** (48 E2E + `HEADER CHECK PASSED` on `/`, `/index.html`, hashed CSS via podman + repo-hygiene gates). No linter exists in this repo (no `lint` script/eslint config). Coverage: no JS/CSS touched — vacuous per phase spec; E2E is the binding gate. - Completion criteria: card count 6 in `src/` **and** `dist/` ✅ · first card "Brain of Reese" with `…/Experimental/brain-of-reese` href in `dist/index.html` ✅ · `grep -c "Self-Hosted Services\|Kubernetes Cluster" src/index.html` = **0** ✅ · AI card has vLLM/Gufo/llama.cpp + LocalAI/LiteLLM/Langfuse, no "Ollama" ✅ · regression test present in `tests/e2e/01-page.spec.js` and passing ✅ · `./build.sh && npm test` green (48 ≥ 45) ✅ · no edits outside `#projects` ✅ · README/AGENTS consistent ✅. - Docs: README **updated** (new paragraph stating what the E2E suite covers, incl. the six featured cards, so future content edits update the matching test). AGENTS.md **updated** (convention: the `#projects` grid is test-locked by `01-page.spec.js`). All other README claims re-checked against reality (Dockerfile builds `dist/` internally, `listen 8080`, snippet `include`s, `check-headers.sh` port/paths/output, `--bind 0.0.0.0` config, Node ≥20 engine floor, CI `main`+tag publishing) — consistent. - Notable: `.agents/validate.sh` is still **untracked** though AGENTS.md/README reference it — harness should `git add` it (I ran no git index commands). `.agents/PLAN.md` §4/§5 still say "44 tests" (suite is 48 since Phases 04/05); PLAN.md is off-limits, so this drift needs an explicit user-approved edit. No live-infrastructure touched. - Next pending phase: none in `.agents/phases/todo/` (05 was last). Remaining unphased audit items (L-3 CSP `unsafe-inline`, L-5 SSH-key labelling, L-7 CI pinning, L-8 build.sh CI check) would need new phases via `phase-authoring`.	2026-10-23 01:32:52 -04:00
ducoterra	2f6f2dc0b9	phase: 04_huntington_role ... **Phase 04 final verification — all green** Implemented/verified - Both phase tasks already complete (`complete/04_huntington_role/01`,`02`); this pass was final verification + docs. - `src/index.html` HNB "Lead MLOps Engineer · Jun 2026 – Present" entry first with 3 bullets; Nimbis closed at `Jan 2022 – Apr 2026`. Tests / lint / gate - `./build.sh` → `dist/` rebuilt (9 hashed assets) · `npm test` → **47 passed, 0 failed** - `bash .agents/validate.sh` → **exit 0**: 47/47 E2E, `HEADER CHECK PASSED` (real podman image, `/`, `/index.html`, hashed css), hygiene checks clean - `node --check` all `src/*.js` + `tests/e2e/*.js` + `playwright.config.js` OK; `bash -n` on `build.sh`, `scripts/check-headers.sh`, `.agents/validate.sh` OK (no JS lint toolchain by design) Completion criteria - `grep -c "Huntington National Bank" dist/index.html` = **1**; `Jun 2026 – Present` at dist:118 — PASS - Nimbis `Jan 2022 – Apr 2026` at dist:138; only one `– Present` in file — PASS - Regression test `experience timeline leads with Huntington National Bank role` present at `tests/e2e/01-page.spec.js:28` and passing — PASS - `./build.sh && npm test` fully green (47 ≥ 45) — PASS · No behavior change: terminal/vim/achievements/menu specs all pass — PASS - Coverage >90% on new/modified code: vacuous (HTML + test only, no JS/CSS touched) — PASS Documentation (fixed) - README: `check-headers.sh` claimed "aborting at the first failing path" — it actually checks all three paths then exits non-zero; also added the real webServer command (`--bind 0.0.0.0`) and `npm run test:headed`. - AGENTS.md: `innerHTML` allowance scoped precisely (only the `cmdText === 'neofetch'` branch in terminal.js; vim/achievements only static or `escapeHtml()`-escaped). Notable: `.agents/PLAN.md` §4/§5 still say "44 tests" (now 47) — PLAN.md is locked to me; flagged for user approval. Next pending phase: `.agents/phases/todo/05_update_projects_section`	2026-10-23 00:36:58 -04:00
ducoterra	bcfaa1cac6	phase: 02_simulate_fetch_commands ... All green. Final report: **Phase 02 — final verification pass** (both tasks already in `.agents/phases/complete/02_simulate_fetch_commands/`) - Verified: no `fetch(` remains in `src/` (grep exit 1) or in built `dist/*.js` - Verified: `simulatedCurlOutput()` / `simulatedWgetOutput()` in `src/terminal-commands.js` (lines 63/73), wired into `src/terminal.js` curl/wget branches - Verified: regression test `curl/wget are simulated — no real network request leaves the origin` in `tests/e2e/02-terminal.spec.js` — asserts simulated bodies, `web_navigator` toast + localStorage persistence, and zero non-`baseURL` requests - Tests: `./build.sh` → OK; `npm test` → **46 passed, 0 failed** (≥46 required); `bash .agents/validate.sh` → **exit 0** (E2E + repo-hygiene gates) - No linter configured beyond validate.sh (vanilla JS, LOCKED no-toolchain) - Completion criteria: ①no `fetch(` ✅ ②simulators present ✅ ③regression tests present & passing ✅ ④build+test 46 green ✅ ⑤no behavior change (page/terminal/vim/achievements/menu suites all green) ✅ - Documentation: full README/AGENTS.md review — both already updated in working tree and consistent with the project (simulated curl/wget, validate.sh gate, Podman build flow vs Dockerfile, Node ≥20 matches `@playwright/test` engines, M-4 header gap correctly documented as pending Phase 03) — **verified consistent, no changes needed** - Note: `PLAN.md` still says "44 tests" (now 46) but PLAN is locked — flagged for the harness/user, not edited - Next pending phase: `03_nginx_security_headers`	2026-10-22 23:14:49 -04:00
ducoterra	dcd066d953	phase: 01_fix_history_xss ... **Phase 01 — final verification pass (all criteria green)** - Verified M-1 fix in `src/terminal.js`: ArrowUp / ArrowDown(`>0`) / ArrowDown-else now route through `updateDisplay()` (`textContent`); no `innerHTML` sink touches `cmdLine`/`commandHistory`. - `grep -n innerHTML src/terminal.js` → 12 hits, all allowed (static prompt literals, `clear`/prank wipes, `outLine.innerHTML = output` gated on the static canned `neofetch` string). **C1 ✓** - XSS regression test at `tests/e2e/02-terminal.spec.js:156` present + passing; re-proved it is a real guard: re-injected the old `innerHTML` recall into `dist/terminal.*.js` → test failed (`#xss-marker` received 1); rebuild → byte-identical to `src/`. **C2 ✓** - `./build.sh` → `dist/` OK; `npm test` → **45 passed (0 failed)**; `bash .agents/validate.sh` → **exit 0** (suite + repo-hygiene gates). **C3 ✓** - Branch coverage of modified code: all 3 recall arms asserted (ArrowUp ×2 specs, ArrowDown `>0` in the existing history spec, ArrowDown-else → empty prompt in the new spec) → >90% gate met; no JS coverage/lint toolchain exists in the locked stack, so lint = `node --check src/*.js tests/e2e/*.js playwright.config.js` + `bash -n build.sh .agents/validate.sh` — clean. - C4 ✓ terminal/vim/achievements/menu specs all green; only the three recall branches changed. - Docs (step 6, full README/AGENTS review): README — run section now states the image already contains the built `dist/` (mount `dist/`, never `src/`); new “Serving & configuration” section for `nginx.conf`, incl. **empirically measured** (built image on 127.0.0.1:8124) that `/`, `/index.html` and hashed assets currently return *only* cache headers — the `add_header` non-merge gap = finding M-4/Phase 03; TLS/HSTS-at-edge rule; Quadlet section fixed (unit is not in this repo; Quadlet generates `homepage.service`, so `… start homepage.service`, and `systemctl enable` is a no-op for transient Quadlet units → `[Install]` + `daemon-reload` + linger); Development gained the Node 20+ floor, `npx playwright install chromium`, and `.agents/validate.sh`. AGENTS.md — added the validate.sh gate, flagged `./scripts/check-headers.sh` as not yet in the repo (Phase 03), and scoped the M-1 rule with the allowed-`innerHTML` list. - Notable: `.agents/PLAN.md` still says “44 tests” (3 places) and its §7 roadmap omits phases 04/05 — left untouched per the no-PLAN-edit rule; flag for the next PLAN review. No live-infra touched (temp podman image built/removed for the header measurement only). - Next pending phase: `02_simulate_fetch_commands`.	2026-10-22 22:45:40 -04:00
ducoterra	3898dc3c5e	Add Playwright E2E suite against the built dist/ ... Pin @playwright/test 1.62.0 (matches the cached chromium revision) and serve dist/ via python3 http.server, so the deployed artifact is what gets tested. Covers page load, terminal commands, vim mode, achievements, and the nav menu. Ignore node_modules, test-results, playwright-report, and the phased-execution runtime scratch (.agents/phase-sessions, pipeline.log).	2026-09-18 17:23:30 -04:00