Repository navigation
fix: expose descendant log dates in calendar month (#984) - #671
Merged
Merged
Conversation
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes Reviewed the complete API change, regression tests, and shared web/mobile calendar consumers.
- Descendant log exposure:
BuildLogsDictnow includes all loaded habit IDs, preserving existing log fields, inclusive range filtering, descending ordering, and top-level entries. - Regression coverage: Tests cover flexible and completed children/grandchildren with empty instances, exact log DTOs, range boundaries, ordering, and zero-valued skips. The targeted calendar handler suite passed all 19 tests.
- Client compatibility: The shared
logsrecord accepts descendant keys without a contract change. Rendering these dates still depends on the planned consumer ticket #985; this API-first change does not regress the existing client path.
openai/gpt-6.1-sol ｜ 𝕏
|
thomasluizon
added a commit
that referenced
this pull request
Sep 30, 2026
thomasluizon
added a commit
that referenced
this pull request
Oct 20, 2026
* Support entry point intent (#532) (#523)
* Open support entry intent work
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VrpPfdSqgp5twko5kzTvf8
* Add support entry point intent
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VrpPfdSqgp5twko5kzTvf8
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Run CI on redesign pull requests (#524)
* chore: initialize #539 pull request
* chore: run CI for redesign pull requests
* fix: compare mutation scope with pull request base
* Add repairable streak gap dates (#518)
* chore: initialize ticket 505
* feat: expose repairable streak gap dates
* chore(arch): regenerate the architecture map for the repairable gap read
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UFozk1UXf4Pm5spEHYxzT1
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Sync redesign API branch with main for #670 (#556)
* Add habit widget empty reason (#527)
* Start #372
* Add habit widget empty reason
* ORB-223: Generate gating matrix from PayGateService (#520)
* chore: start ORB-223
* feat: generate gating matrix
* fix: fail closed on unreadable plan gates
* fix: close gating matrix parser gaps
* fix: preserve plans in combined guards
* fix: distinguish quota lifted plans
* fix: carry plan provenance through quota aliases
Derived quota variables were recorded unscoped and only the variable that
literally contains the plan ternary was relabelled afterwards, so plan
provenance did not survive a local alias. A semantics-preserving
`var selectedLimit = user.HasProAccess ? proLimit : freeLimit;
var messageLimit = selectedLimit;` generated cleanly and changed
CanSendAiMessage.quotaLiftedByPlan from "Pro" to null.
The directly plan-selected variables are now labelled first, and the
fixed-point propagation carries the source variable's exact plan instead of
null. An assignment deriving from two different plans cannot have its
provenance proven, so generation fails closed with the same
"cannot derive plan requirement" error the other unprovable shapes use.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: fail closed on unknown gating sources
* fix: derive feature flags from migrations
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: fall back to Claude only when the Codex reviewer step fails (#529)
Mirrors thomasluizon/orbit-ui-mobile#1022.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Let the executor own the MCP confirmation gate (#599) (#534)
* fix: let the executor own the MCP confirmation gate (#599)
Every MCP tool whose capability requires a confirmation or a step-up was
refused forever. The selective-auth middleware evaluated the policy a second
time, in front of the executor, and it never received the caller's
confirmation token. A client that stepped up and retried with a valid token
got the identical refusal, because the token never reached that evaluation.
Carrying the token into the middleware cannot fix it. A confirmation token is
single use and is bound to the pending operation's fingerprint, and the
middleware computes a different fingerprint from the raw MCP arguments than
the executor computes from the operation id and its snake_case argument
object. One token cannot satisfy two gates.
So the middleware now steps aside for a confirmation-gated capability, the
same way it already steps aside for execute_agent_operation_v2. Both reach
IAgentOperationExecutor, which evaluates access and confirmation together,
holds the token, and writes the audit row.
Two guard tests pin the invariants the deferral rests on: a confirmation
requirement always sits on a mutation, and every confirmation-gated MCP tool
reaches the executor through McpExecutorBridge.
Also corrected: the step-up message and the three tool parameter descriptions
named verify_step_up_agent_operation_v2 as the source of the confirmation
token. It does not return one. confirm_agent_operation_v2 does.
Removed AgentPolicyEvaluationContext.StepUpSatisfied. Nothing ever set it and
nothing ever read it; the real step-up state lives on
PendingAgentOperationState.StepUpSatisfiedAtUtc.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: thread the confirmation token through the bulk habit tools (#599)
bulk_log_habits and bulk_skip_habits declared no confirmationToken
parameter and their shared helper hardcoded confirmationToken: null, so
their HabitsBulkWrite capability (FreshConfirmation) could never see a
token and both tools stayed permanently refused. Both now declare the
parameter and ExecuteBulkHabitOperationAsync forwards it.
Three new guards in ConfirmationGatedMcpToolsRouteThroughExecutorTests
pin what the old one missed. The scan now asserts it reaches exactly the
catalog's gated MCP tools, that each tool's forwarded operation id
resolves to a capability with the same ConfirmationRequirement, and that
each tool accepts and forwards a confirmation token. The source scan
walks subfolders and keys members by their declaration rather than by the
first invocation-shaped token in the chunk.
AgentOperationExecutor writes an AgentAuditLogs row before returning
UnknownOperation, restoring the trail the middleware used to leave.
McpConfirmationGateTests now drives the real AgentTools recovery methods
end to end and pins that all three refuse an API-key credential.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: resolve the forwarded MCP confirmation token back to the tool parameter (#599)
The token guard whitelisted one spelling of null. It flagged a bridge call only
when the confirmation-token argument was absent or the literal `null`, so
`confirmationToken: default`, `null!`, `(string?)null` and `""` all passed while
the tool stayed refused forever. A longer literal list does not close that,
because the next spelling is not on the list either.
Assert the structural property instead: a gated tool declares a
`string? confirmationToken` parameter, and the expression it forwards into the
executor's token slot resolves back to that identifier, directly or through one
helper hop. Every other expression fails, whatever it spells.
The declaration check now reads the tool's parameter list rather than its whole
body, so a local named `confirmationToken` no longer satisfies it.
Also add `forwarded.Id == tool.Capability.Id` to the operation-id guard. It
compared only the confirmation requirement, so a gated tool could forward
another gated capability's operation id, keep confirmation firing, and have the
executor enforce the wrong scope.
The file's doc comment said four invariants and listed four; the file holds
five. Name the source-scan invariant the other three rest on.
Six mutations, each red on its own, real tree green at every step:
`confirmationToken: default`, `null!`, `(string?)null`, `""`, a gated tool
forwarding a different local, and `delete_tag` forwarding `delete_goal`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: strip only a real named-argument prefix in the MCP guard parser (#599)
ArgumentAt treated any colon as a named-argument separator, so a conditional
expression in the token slot or the operation-id slot collapsed to its
else-branch. `ids.Count > 0 ? null : confirmationToken` read as
`confirmationToken` and `tagId.Length > 0 ? "delete_goal" : "delete_tag"` read
as `"delete_tag"`, and both guards stayed green over the restored defect.
Match `^\w+\s*:(?!:)` instead, so only a leading `name:` prefix is stripped and
every other expression reaches the resolver whole. The anchor keeps a colon
inside a string literal and a `::` qualifier from matching.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: separate an omitted caller argument from a non-parameter expression (#599)
ResolveExpression returned the expression itself both when it was not a callee
parameter and when the caller supplied nothing at that index. The second case
handed back the helper's own parameter name, which then compared equal to
`confirmationToken` and passed. Giving the helper an optional
`string? confirmationToken = null` and calling it without that argument restored
the #599 defect with the guard green.
Return the `<omitted>` sentinel for the second case instead. It can never equal
the parameter name, and it resolves to no capability in the operation-id slot,
so both guards fail closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: read a gated tool's direct and helper bridge calls together (#599)
CollectBridgeCalls returned early as soon as the tool body held one bridge
call, so a correct call in a dead branch hid every helper call in the same
tool. A decoy `if (tagId.Length == 0)` block forwarding `confirmationToken`
plus a same-file helper forwarding `null` restored the #599 defect with the
guard green.
Collect both sets instead. Every bridge call a gated tool can reach, directly
or through one helper hop, now has to forward the parameter.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: refuse a gated tool that assigns to its own confirmationToken (#599)
The rule compared the forwarded expression's text only, so
`confirmationToken = null;` above the bridge call restored the #599 defect with
the forwarded identifier unchanged and the guard green.
Add an offender when the tool body, or a same-file helper it reaches, assigns
to the parameter. MemberSource now carries its statements with the parameter
list excluded, so the declaration's own `string? confirmationToken = null`
default does not match. The pattern `\bconfirmationToken\s*=[^=>]` leaves `==`,
`!=`, `>=`, `<=`, `??=` and a lambda arrow alone.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs: say what the MCP token resolver models, not more (#599)
Invariant 5 claimed "any other expression in the token slot refuses the tool
forever" and that the tool forwards the identifier "directly or through a
helper it calls". A conditional refuses the tool on some paths only, and the
resolver models exactly one same-file helper hop matched by argument position.
Replace both sentences with what the scan actually does, and state its limits:
two or more hops read as no bridge call and fail the routing guard, and
aliasing, reflection and an interface call are outside the model.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: catch a compound assignment to confirmationToken (#599)
The assignment rule was anchored on `\s*=`, and `\s*` cannot cross the `??`
of `??=` or the `+` of `+=`. So `confirmationToken ??= tagId;` above the
bridge call compiled green with all five guards green, and a later change
that writes `confirmationToken ??= await ResolveStoredTokenAsync(...)` would
hand the executor a token the MCP caller never sent: HasFreshConfirmation is
then satisfied from state the caller does not control, while the middleware
has already stepped aside.
Admit the two compound operators a `string?` can carry. `==` still fails on
the second `=`, `!=`, `>=` and `<=` still fail because those characters break
`\s*` and are not in the alternation, `=>` still fails on the trailing
character class, and a bare `??` with no `=` still fails.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: read every same-named helper an MCP tool could be calling (#599)
The member index was a dictionary keyed on the bare name and built with
group.First(), so two same-named members collapsed to whichever was declared
first. The scan then analysed a method the tool never calls. It broke both
ways: a decoy overload declared after the real helper and forwarding null was
green, and a gated tool calling a correct overload reddened when an unrelated
same-named member happened to be declared first.
Hold every member under its name and, at each call site, read every candidate
whose parameter count can admit that many arguments. One candidate resolves
the call; more than one is ambiguous, so all of them are read and any bad one
reddens the tool. That fails closed instead of guessing, and it costs no false
red in the case above, where only the real helper carries a bridge call. A
name that admits no candidate stays unresolved, which hides nothing: the
bridge call inside it is not collected either, so the routing guard reddens
the tool.
Arity, not the parameter type, is what decides a candidate. The scan is a text
scan, so it cannot type-check an argument.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs: say what invariant 5 now refuses and what it still cannot see (#599)
The general claim "refuses a tool that assigns to the parameter" is now exact:
`=`, `??=` and `+=`. The helper hop no longer claims a "matching argument
position", because the resolver pairs by position alone and strips a
named-argument prefix without reading the name, so arguments named out of the
declared order are read wrong. The comment said nothing about overloads, so
say that an ambiguous name is read as every candidate and reddens the tool.
Close with the honest limit: a text scan is defeatable by an author who sets
out to defeat it, and what the guard closes is every shape an ordinary
refactor produces.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Fix calendar event timezone projection (#521)
* Start calendar timezone fix
* Fix calendar event timezone projection
* Fix projected calendar end times
* Fix calendar end time during DST fallback
* Fix calendar end time minute precision
* Fix projected calendar recurrence rule
* Guard calendar recurrence across timezone shifts
* Project calendar recurrence weekdays
* Keep calendar recurrence unchanged
* Omit unrepresentable recurring calendar events
* Gate projected calendar recurrence on the whole fetch window
Closes the six review findings on pull request 521.
1. The weekday gate now walks every expanded occurrence Google returned for a
recurring master, not the one sampled instance. The fetcher collects each
instance start with the source calendar's own offset into a JsonIgnore'd
ExpandedOccurrences list, so a Lisbon BYDAY=TH series that is stable in
January and shifts to Wednesday in July is refused. The empty list still
falls back to the sampled instance for an all-day series and for a
suggestion row read back from the database.
2. The legacy title plus date plus time key only excludes a suggestion when
exactly one candidate carries it. Inside a fall-back repeated hour two
events project to the same local time, so the key proves nothing and both
stay. This mirrors the group.Count() == 1 guard the auto sync reconciler
already applies to the same key.
3. An omitted end time now logs its reason at Debug with the event id and the
user id. EndUtc already ships the real duration, so the client keeps it.
4. The refusal here and the clamp in HabitScheduleService.IsMonthlyMatch are
reconciled in a doc comment: Orbit clamps a rule it owns and refuses a rule
it imports and cannot re-express without inventing a weekday.
5. Both new call sites pass the logger and the user id to FindTimeZone, which
also catches InvalidTimeZoneException so a corrupt zone stops escaping as a
500. User.SetTimeZone trims at the boundary and rejects a blank id.
6. Asia/Kathmandu at plus 05:45 and Pacific/Chatham at plus 12:45 cover the
sub hour offset gap.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Prove calendar recurrence stability from both zones
Round 6 gated a BYDAY series on the expanded instances Google returned, and
GoogleCalendarApi only asks for sixty days, so a series whose transition falls
outside that window was admitted and a stored suggestion row never carried the
instances at all.
The gate now reads the source calendar's own timezone from the recurring master
the fetcher already fetches, and walks a year of dates at the occurrence's source
wall clock through both zones' rules. A series it cannot prove stable is withheld
from both feeds. StoredCalendarEventJson carries the source zone beside the stored
suggestion, so the suggestion feed judges a row on the same evidence the events
feed had.
Also in scope: the auto-sync reconciler projects a fetched event into the account
timezone before matching a legacy habit, the end-time omission logs whatever EndUtc
holds, and an all-day event no longer reports Google's exclusive end date as an
end instant.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Keep calendar series a spring forward gap cannot move
A probe date whose source wall clock a spring forward gap removes is a date
the series does not fire on, not evidence the series moves. The walk ended
there with "unproved" and the gate withheld the whole series, so an account
reading a calendar kept in its own zone lost an hour wide band in thirteen
DST zones even though the projection is the identity.
HasUnrepresentableRecurrenceAfterProjection now answers false as soon as
TimeZoneInfo.HasSameRules holds, and the walk skips a wall clock its own zone
removes instead of ending. RFC 5545 section 3.3.5 does define the missing
case, but probing that normalized instant changes no decision for any of the
14,752 zone pairs that could distinguish it, and asserting an expansion
Google does not document would let one guessed date withhold a year.
Also pins what earlier rounds argued: auto-sync refusing to store or notify a
withheld series, JsonIgnore keeping SourceTimeZone off the response body, the
repeated hour needing both of its instants, the probe reaching a full year,
and an all day event logging no dropped end time. A stored SourceTimeZone key
holding a number now reads as no source zone rather than failing the request.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Fix recurring calendar timezone proof and legacy refresh
* Avoid refreshing legacy calendar rows with duplicate event IDs
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Bump FluentAssertions and 23 others (#538)
Bumps FluentAssertions from 8.10.0 to 8.11.0
Bumps Google.Apis.AndroidPublisher.v3 from 1.75.0.4246 to 1.76.0.4277
Bumps Hangfire.AspNetCore from 1.8.24 to 1.8.25
Bumps Hangfire.Core from 1.8.24 to 1.8.25
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.OpenApi from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.ApiDescription.Server from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Caching.Abstractions from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Caching.Memory from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Http from 10.0.11 to 10.0.12
Bumps Microsoft.IdentityModel.JsonWebTokens from 8.22.0 to 8.23.0
Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1
Bumps OpenAI from 2.13.0 to 2.14.0
Bumps PostHog from 2.14.0 to 2.15.7
Bumps PostHog.AspNetCore from 2.9.0 to 2.9.7
Bumps Scalar.AspNetCore from 2.17.1 to 2.17.9
Bumps Sentry.AspNetCore from 6.9.0 to 6.11.1
Bumps Stripe.net from 52.3.0 to 52.4.2
---
updated-dependencies:
- dependency-name: Google.Apis.AndroidPublisher.v3
dependency-version: 1.76.0.4277
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Hangfire.AspNetCore
dependency-version: 1.8.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Hangfire.Core
dependency-version: 1.8.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Hangfire.Core
dependency-version: 1.8.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.Design
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.Relational
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.ApiDescription.Server
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Caching.Abstractions
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Caching.StackExchangeRedis
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Http
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.IdentityModel.JsonWebTokens
dependency-version: 8.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: OpenAI
dependency-version: 2.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: PostHog
dependency-version: 2.15.7
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: PostHog.AspNetCore
dependency-version: 2.9.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Scalar.AspNetCore
dependency-version: 2.17.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Sentry.AspNetCore
dependency-version: 6.11.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Stripe.net
dependency-version: 52.4.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: FluentAssertions
dependency-version: 8.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Caching.Memory
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: FluentAssertions
dependency-version: 8.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: FluentAssertions
dependency-version: 8.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Give API key management one authorization concept with two doors (#528)
* Start #529 API key step up
* Require API key management step up
* chore: regenerate the architecture map
The step up change moved the API key endpoints' shape, so `architecture.json`
and `architecture.html` no longer matched the tree and the `drift` check
failed on `git diff --exit-code`. Regenerated with `node tools/arch-map.mjs`,
which reports 45 entities and 0 untested feature folders.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Give API key management one authorization concept with two doors
Listing, creating and revoking API keys now read one grant. Two doors open
it, and both end in a six-digit code emailed to the account owner: the HTTP
challenge, and a verified agent step-up.
Creating key material spends the grant. Listing and revoking only read it,
so one emailed code authorizes a management session instead of exactly one
revoke. A revoke no longer locks the person out of the key list.
get_api_keys gets a door. RequireApiKeyCreationStepUp raises the read
capability to a step-up inside the executor, so the read opens a pending
operation the caller can step up against, and the MCP read routes through
McpExecutorBridge like the mutation does.
AppConfigService now parses a stored row strictly and throws by name when a
row is malformed, so a typo cannot leave the gate off while the read-back
reports it on.
Both controller actions declare 403 and 428, and openapi.json carries them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Cover API key step up through merged MCP gate
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Expose habit emoji in MCP tools (#513) (#546)
* Open ticket 513 implementation review
* Expose habit emoji across MCP tools (#513)
* Prevent stale pull request workflow runs for #659 (#555)
* Start #659 workflow concurrency change
* Group core PR workflows by pull request for #659
* Group remaining PR workflows by pull request for #659
* Fix #657 logout revocation across a session family (#553)
* Start #657 session family fix
* Revoke the full auth session after logout (#657)
* Explain temporary legacy token allowance (#657)
* Handle duplicate refresh history race (#657)
* Fix #588 bulk habit interval weeks (#539)
* Start #588 bulk interval weeks fix
* Fix #588 bulk habit interval weeks mapping
* Guarantee crisis resources in Astra chat for #319 (#547)
* Add crisis guidance to Astra static prompt for #319
* Add curated crisis detection and regression cases for #319
* Wire crisis guard across chat delivery and metrics for #319
* Refine crisis delivery and cover fallback regression for #319
* Return static crisis support when AI chat fails for #319
* Keep crisis FAQ regression isolated for #319
* Fix crisis replies to bypass AI quota and provider
* Record streak freeze source for #571 (#540)
* Start #571 freeze source work
* Record streak freeze origin for #571
* Require explicit origin for new streak freezes
* Keep support tool available for support entry point (#541)
* Expose scheduled streak repair gap dates for #505 (#542)
* Fix standalone sub habit title validation for #628 (#543)
* Start #628 sub habit title validation fix
* Use sub habit title messages in standalone validation (#628)
* Carry the onboarding repeat interval into the created habit (#596) (#533)
A signed-out person who set a weekly repeat interval during onboarding lost
it at sign-up. ApplyHabitInput carried no interval field at all, so the apply
path dropped the value between the screen and the record.
Add an optional IntervalWeeks to ApplyHabitInput, additive only, and pass it
to Habit.Create alongside the other schedule options. No existing field
changes name, shape or nullability, so a client that sends nothing keeps the
behaviour it has today: IntervalWeeks stays null and the habit repeats every
week.
Validate the new field with the shared SharedHabitRules.AddIntervalWeeksRules
range, the same 1 to 52 bound every other create path uses.
Regenerate openapi.json and architecture.json/html for the new field and for
the test class that now touches HabitScheduleService.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Expose recurrence time zone in calendar events for #591 (#544)
* Start #591 recurrence time zone work
* Expose recurring calendar event time zone for #591
* Restore recurrence time zone in legacy suggestions for #591
* Project safe calendar BYDAY recurrences (#569) (#545)
* Start calendar BYDAY projection (#569)
* Project uniform calendar BYDAY recurrences (#569)
* Cover alternate week recurrence projection (#569)
* Keep shifted calendar rules importable by installed clients
* Add closed week and year recap ranges for #369 (#548)
* Fix Google sign-in after concurrent user updates (#551)
* chore: start ticket 324 review
* fix: retry concurrent Google sign-in updates (#324)
* Fix duplicate agent confirmation consumption (#557)
* Start fix for ticket 671 confirmation race
* Claim agent confirmation once under concurrent saves
* chore: regenerate the architecture map for the confirmation claim migration (#671)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: show newest habit completion date in profile (#549)
* chore: start ticket 391
* fix: expose latest habit completion date in profile
* fix: exclude bad habit slips from last completion date
* fix: pass the freeze origin in the profile freeze test after #540 (#391)
The merge with main brought StreakFreeze.Create's required origin
parameter (#540). The test now asserts that a freeze without a
completion leaves lastCompletionDate null for both origins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preserve last completion across habit cleanup (#391)
* Preserve descendant completions during sync cleanup
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix: resolve stored recap week anchors without the current preference
A closed week anchor lives in the recap share link and in the stored
snapshot key. Validating it against today's WeekStartDay rejected a
Monday anchor after the person moved to Sunday, before the stored
snapshot could be read. Accept any supported week start (Sunday or
Monday) for an explicit closed anchor.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Redesign the transactional emails, AI push copy and error messages (R20) (#532)
* Add habit widget empty reason (#527)
* Start #372
* Add habit widget empty reason
* ORB-223: Generate gating matrix from PayGateService (#520)
* chore: start ORB-223
* feat: generate gating matrix
* fix: fail closed on unreadable plan gates
* fix: close gating matrix parser gaps
* fix: preserve plans in combined guards
* fix: distinguish quota lifted plans
* fix: carry plan provenance through quota aliases
Derived quota variables were recorded unscoped and only the variable that
literally contains the plan ternary was relabelled afterwards, so plan
provenance did not survive a local alias. A semantics-preserving
`var selectedLimit = user.HasProAccess ? proLimit : freeLimit;
var messageLimit = selectedLimit;` generated cleanly and changed
CanSendAiMessage.quotaLiftedByPlan from "Pro" to null.
The directly plan-selected variables are now labelled first, and the
fixed-point propagation carries the source variable's exact plan instead of
null. An assignment deriving from two different plans cannot have its
provenance proven, so generation fails closed with the same
"cannot derive plan requirement" error the other unprovable shapes use.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: fail closed on unknown gating sources
* fix: derive feature flags from migrations
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: fall back to Claude only when the Codex reviewer step fails (#529)
Mirrors thomasluizon/orbit-ui-mobile#1022.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Redesign the transactional emails, AI push copy and error messages
Closes thomasluizon/orbit-tickets#75 (R20).
Emails. All 7 types plus the shared wrapper move to the granted canon: the
violet #7F46F7 becomes the warm orange #C4530F, the gradient header band and
every CTA glow are gone (DESIGN.md bans both), Rubik and Inter become the
Geist Sans and Geist Mono stacks, and the planet emoji and sparkle bullets
give way to the mark and a plain numbered list. Emails now author light and
override dark through prefers-color-scheme, which matches "light mode
MANDATORY, dark primary" and survives a forced inversion far better than the
dark only document did. Copy is rewritten in both languages to say what
happened before what to do next. Support copy moves out of its template into
EmailCopy so markup holds no strings.
AI push copy. The slip alert, proactive check in and daily summary prompts
demonstrated an exclamation mark and a doubled hyphen inside their own worked
examples, and at temperature 0.9 the model reproduced both. One shared voice
contract, NotificationVoice, now states each ban and carries no example at
all. The fallback strings carried the same two tells and are rewritten.
Error messages. A domain guard firing is an ordinary event, but its message
is the sentence a developer wrote, and on 2026-08-05 a tester read "Days can
only be set when frequency quantity is 1." verbatim, in English, inside a
pt-BR interface. ErrorCopy now maps every error code to user facing copy in
both languages, and one result filter swaps the message at the response
boundary. DomainErrors stays developer facing, as the ticket requires. The
catalog is total over ErrorCodes, ErrorMessages and DomainErrors, and a
reflection test fails the build when a constant arrives without copy, so the
raw message fallback is unreachable. ErrorMessages now takes its English from
the same catalog rather than repeating 145 sentences in a second file.
AppError and Result carry the arguments behind a {0} placeholder so the
localized template can be formatted with the same values, which the eagerly
formatted message alone no longer exposed.
Also removed: five pay gate strings ending in "Upgrade to unlock!", a banned
word and an exclamation on a sell; inlined copies of error sentences in three
chat tools; and a hardcoded 500 envelope message.
Tests: 6980 passing, 0 failing. Line coverage 86.40%.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Build the banned dashes from code points and refresh the architecture map
Two red checks on PR 532 at c50f052e.
Dash Ban. The three new voice tests detected a banned dash by embedding one,
and the gate scans a test file like any other. The two constants are now built
from their code points, ((char)0x2014) and ((char)0x2013), so no literal
character sits in the source. The escape form these files were written with
did not survive: the lefthook pre-commit step runs dotnet format, which
normalized "—" back into the raw character before the commit landed. A
code point arithmetic expression has no literal for a formatter to normalize.
The assertions are unchanged. Verified by injecting a real em dash into one
ErrorCopy entry and one EmailCopy string: EveryEntryObeysTheErrorVoice and
NoEmailStringCarriesADashCharacter both went red, then green again once the
injection was reverted.
drift. architecture.json and architecture.html were stale against the new
test classes and the changed file counts. Regenerated with node
tools/arch-map.mjs and committed here, in the change that requires them. The
generator is deterministic: two consecutive runs are byte identical.
tools/dash-baseline.json is untouched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Fix the four blocking findings on the email and error copy pass
C1: the deletion email promised a permanent wipe while the product only
deactivates. The intro now states the grace window, read from
AppConstants.MaxDeletionGraceDays, and that signing in again cancels it.
C2: the copy pass had moved the wrong-code failure onto a new error code
both shipped clients have no branch for, which sends Orbit 1.3.31 and the
web step-up screen to a generic error. The code returns to
INVALID_VERIFICATION_CODE, and the count rides in a counted copy variant
that keeps the trailing token those clients parse.
C3: the reply language came from Accept-Language alone, which neither the
Android app nor the web Server Actions send, so every signed-in pt-BR
reader got English. RequestLanguageResolver reads the stored
User.Language first and keeps the header as the anonymous fallback. The
header parse now honours quality values.
C4: the slip alert claimed the usual time had arrived, while the
scheduler sends two hours early and at 08:00 when no peak hour exists.
The prompt states when the push lands and the fallback makes no time
claim without a peak hour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Make the copy claims match the code that produces them
C5: the check-in fallback called one open habit "a few" and promised that
Astra records the rest. The scheduler sends as soon as one habit is off
track, and LogHabitTool records only the habit a person names.
C6: the 429 body was an anonymous object the localizing filter could not
match, so the RATE_LIMITED copy was unreachable. It is built from
ErrorMessages.TooManyRequests now, which also gives the 429 an error code
for the first time. Retry-After and the request id already ride in
headers.
C8: the sync copy promised a reload and a later send that no caller
performs. C9: a challenge does not take part, people do. C10: the recap
arrives only for a reader with a push subscription, so the copy points at
coming back instead.
D1 and D4: two doc comments claimed more than the code does. The filter
covers ErrorResponse bodies only, and a FluentValidation message never
reaches it. A missing catalog entry throws on the first request, not at
startup.
D3: BuildSummaryPrompt is internal and joins both voice theory sources,
so the guard written for its doubled-hyphen leak now reaches it.
D5: AppError compared Args by reference, so two errors formatted with the
same count came out unequal. Equality walks the arguments now.
The three voice tests that read NotificationVoice.Rules' own literals
back out of it now assert the bans over every prompt a model receives.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Refresh the architecture map for the review round
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Let the executor own the MCP confirmation gate (#599) (#534)
* fix: let the executor own the MCP confirmation gate (#599)
Every MCP tool whose capability requires a confirmation or a step-up was
refused forever. The selective-auth middleware evaluated the policy a second
time, in front of the executor, and it never received the caller's
confirmation token. A client that stepped up and retried with a valid token
got the identical refusal, because the token never reached that evaluation.
Carrying the token into the middleware cannot fix it. A confirmation token is
single use and is bound to the pending operation's fingerprint, and the
middleware computes a different fingerprint from the raw MCP arguments than
the executor computes from the operation id and its snake_case argument
object. One token cannot satisfy two gates.
So the middleware now steps aside for a confirmation-gated capability, the
same way it already steps aside for execute_agent_operation_v2. Both reach
IAgentOperationExecutor, which evaluates access and confirmation together,
holds the token, and writes the audit row.
Two guard tests pin the invariants the deferral rests on: a confirmation
requirement always sits on a mutation, and every confirmation-gated MCP tool
reaches the executor through McpExecutorBridge.
Also corrected: the step-up message and the three tool parameter descriptions
named verify_step_up_agent_operation_v2 as the source of the confirmation
token. It does not return one. confirm_agent_operation_v2 does.
Removed AgentPolicyEvaluationContext.StepUpSatisfied. Nothing ever set it and
nothing ever read it; the real step-up state lives on
PendingAgentOperationState.StepUpSatisfiedAtUtc.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: thread the confirmation token through the bulk habit tools (#599)
bulk_log_habits and bulk_skip_habits declared no confirmationToken
parameter and their shared helper hardcoded confirmationToken: null, so
their HabitsBulkWrite capability (FreshConfirmation) could never see a
token and both tools stayed permanently refused. Both now declare the
parameter and ExecuteBulkHabitOperationAsync forwards it.
Three new guards in ConfirmationGatedMcpToolsRouteThroughExecutorTests
pin what the old one missed. The scan now asserts it reaches exactly the
catalog's gated MCP tools, that each tool's forwarded operation id
resolves to a capability with the same ConfirmationRequirement, and that
each tool accepts and forwards a confirmation token. The source scan
walks subfolders and keys members by their declaration rather than by the
first invocation-shaped token in the chunk.
AgentOperationExecutor writes an AgentAuditLogs row before returning
UnknownOperation, restoring the trail the middleware used to leave.
McpConfirmationGateTests now drives the real AgentTools recovery methods
end to end and pins that all three refuse an API-key credential.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: resolve the forwarded MCP confirmation token back to the tool parameter (#599)
The token guard whitelisted one spelling of null. It flagged a bridge call only
when the confirmation-token argument was absent or the literal `null`, so
`confirmationToken: default`, `null!`, `(string?)null` and `""` all passed while
the tool stayed refused forever. A longer literal list does not close that,
because the next spelling is not on the list either.
Assert the structural property instead: a gated tool declares a
`string? confirmationToken` parameter, and the expression it forwards into the
executor's token slot resolves back to that identifier, directly or through one
helper hop. Every other expression fails, whatever it spells.
The declaration check now reads the tool's parameter list rather than its whole
body, so a local named `confirmationToken` no longer satisfies it.
Also add `forwarded.Id == tool.Capability.Id` to the operation-id guard. It
compared only the confirmation requirement, so a gated tool could forward
another gated capability's operation id, keep confirmation firing, and have the
executor enforce the wrong scope.
The file's doc comment said four invariants and listed four; the file holds
five. Name the source-scan invariant the other three rest on.
Six mutations, each red on its own, real tree green at every step:
`confirmationToken: default`, `null!`, `(string?)null`, `""`, a gated tool
forwarding a different local, and `delete_tag` forwarding `delete_goal`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: strip only a real named-argument prefix in the MCP guard parser (#599)
ArgumentAt treated any colon as a named-argument separator, so a conditional
expression in the token slot or the operation-id slot collapsed to its
else-branch. `ids.Count > 0 ? null : confirmationToken` read as
`confirmationToken` and `tagId.Length > 0 ? "delete_goal" : "delete_tag"` read
as `"delete_tag"`, and both guards stayed green over the restored defect.
Match `^\w+\s*:(?!:)` instead, so only a leading `name:` prefix is stripped and
every other expression reaches the resolver whole. The anchor keeps a colon
inside a string literal and a `::` qualifier from matching.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: separate an omitted caller argument from a non-parameter expression (#599)
ResolveExpression returned the expression itself both when it was not a callee
parameter and when the caller supplied nothing at that index. The second case
handed back the helper's own parameter name, which then compared equal to
`confirmationToken` and passed. Giving the helper an optional
`string? confirmationToken = null` and calling it without that argument restored
the #599 defect with the guard green.
Return the `<omitted>` sentinel for the second case instead. It can never equal
the parameter name, and it resolves to no capability in the operation-id slot,
so both guards fail closed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: read a gated tool's direct and helper bridge calls together (#599)
CollectBridgeCalls returned early as soon as the tool body held one bridge
call, so a correct call in a dead branch hid every helper call in the same
tool. A decoy `if (tagId.Length == 0)` block forwarding `confirmationToken`
plus a same-file helper forwarding `null` restored the #599 defect with the
guard green.
Collect both sets instead. Every bridge call a gated tool can reach, directly
or through one helper hop, now has to forward the parameter.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: refuse a gated tool that assigns to its own confirmationToken (#599)
The rule compared the forwarded expression's text only, so
`confirmationToken = null;` above the bridge call restored the #599 defect with
the forwarded identifier unchanged and the guard green.
Add an offender when the tool body, or a same-file helper it reaches, assigns
to the parameter. MemberSource now carries its statements with the parameter
list excluded, so the declaration's own `string? confirmationToken = null`
default does not match. The pattern `\bconfirmationToken\s*=[^=>]` leaves `==`,
`!=`, `>=`, `<=`, `??=` and a lambda arrow alone.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs: say what the MCP token resolver models, not more (#599)
Invariant 5 claimed "any other expression in the token slot refuses the tool
forever" and that the tool forwards the identifier "directly or through a
helper it calls". A conditional refuses the tool on some paths only, and the
resolver models exactly one same-file helper hop matched by argument position.
Replace both sentences with what the scan actually does, and state its limits:
two or more hops read as no bridge call and fail the routing guard, and
aliasing, reflection and an interface call are outside the model.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: catch a compound assignment to confirmationToken (#599)
The assignment rule was anchored on `\s*=`, and `\s*` cannot cross the `??`
of `??=` or the `+` of `+=`. So `confirmationToken ??= tagId;` above the
bridge call compiled green with all five guards green, and a later change
that writes `confirmationToken ??= await ResolveStoredTokenAsync(...)` would
hand the executor a token the MCP caller never sent: HasFreshConfirmation is
then satisfied from state the caller does not control, while the middleware
has already stepped aside.
Admit the two compound operators a `string?` can carry. `==` still fails on
the second `=`, `!=`, `>=` and `<=` still fail because those characters break
`\s*` and are not in the alternation, `=>` still fails on the trailing
character class, and a bare `??` with no `=` still fails.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: read every same-named helper an MCP tool could be calling (#599)
The member index was a dictionary keyed on the bare name and built with
group.First(), so two same-named members collapsed to whichever was declared
first. The scan then analysed a method the tool never calls. It broke both
ways: a decoy overload declared after the real helper and forwarding null was
green, and a gated tool calling a correct overload reddened when an unrelated
same-named member happened to be declared first.
Hold every member under its name and, at each call site, read every candidate
whose parameter count can admit that many arguments. One candidate resolves
the call; more than one is ambiguous, so all of them are read and any bad one
reddens the tool. That fails closed instead of guessing, and it costs no false
red in the case above, where only the real helper carries a bridge call. A
name that admits no candidate stays unresolved, which hides nothing: the
bridge call inside it is not collected either, so the routing guard reddens
the tool.
Arity, not the parameter type, is what decides a candidate. The scan is a text
scan, so it cannot type-check an argument.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* docs: say what invariant 5 now refuses and what it still cannot see (#599)
The general claim "refuses a tool that assigns to the parameter" is now exact:
`=`, `??=` and `+=`. The helper hop no longer claims a "matching argument
position", because the resolver pairs by position alone and strips a
named-argument prefix without reading the name, so arguments named out of the
declared order are read wrong. The comment said nothing about overloads, so
say that an ambiguous name is read as every candidate and reddens the tool.
Close with the honest limit: a text scan is defeatable by an author who sets
out to defeat it, and what the guard closes is every shape an ordinary
refactor produces.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Fix calendar event timezone projection (#521)
* Start calendar timezone fix
* Fix calendar event timezone projection
* Fix projected calendar end times
* Fix calendar end time during DST fallback
* Fix calendar end time minute precision
* Fix projected calendar recurrence rule
* Guard calendar recurrence across timezone shifts
* Project calendar recurrence weekdays
* Keep calendar recurrence unchanged
* Omit unrepresentable recurring calendar events
* Gate projected calendar recurrence on the whole fetch window
Closes the six review findings on pull request 521.
1. The weekday gate now walks every expanded occurrence Google returned for a
recurring master, not the one sampled instance. The fetcher collects each
instance start with the source calendar's own offset into a JsonIgnore'd
ExpandedOccurrences list, so a Lisbon BYDAY=TH series that is stable in
January and shifts to Wednesday in July is refused. The empty list still
falls back to the sampled instance for an all-day series and for a
suggestion row read back from the database.
2. The legacy title plus date plus time key only excludes a suggestion when
exactly one candidate carries it. Inside a fall-back repeated hour two
events project to the same local time, so the key proves nothing and both
stay. This mirrors the group.Count() == 1 guard the auto sync reconciler
already applies to the same key.
3. An omitted end time now logs its reason at Debug with the event id and the
user id. EndUtc already ships the real duration, so the client keeps it.
4. The refusal here and the clamp in HabitScheduleService.IsMonthlyMatch are
reconciled in a doc comment: Orbit clamps a rule it owns and refuses a rule
it imports and cannot re-express without inventing a weekday.
5. Both new call sites pass the logger and the user id to FindTimeZone, which
also catches InvalidTimeZoneException so a corrupt zone stops escaping as a
500. User.SetTimeZone trims at the boundary and rejects a blank id.
6. Asia/Kathmandu at plus 05:45 and Pacific/Chatham at plus 12:45 cover the
sub hour offset gap.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Prove calendar recurrence stability from both zones
Round 6 gated a BYDAY series on the expanded instances Google returned, and
GoogleCalendarApi only asks for sixty days, so a series whose transition falls
outside that window was admitted and a stored suggestion row never carried the
instances at all.
The gate now reads the source calendar's own timezone from the recurring master
the fetcher already fetches, and walks a year of dates at the occurrence's source
wall clock through both zones' rules. A series it cannot prove stable is withheld
from both feeds. StoredCalendarEventJson carries the source zone beside the stored
suggestion, so the suggestion feed judges a row on the same evidence the events
feed had.
Also in scope: the auto-sync reconciler projects a fetched event into the account
timezone before matching a legacy habit, the end-time omission logs whatever EndUtc
holds, and an all-day event no longer reports Google's exclusive end date as an
end instant.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Keep calendar series a spring forward gap cannot move
A probe date whose source wall clock a spring forward gap removes is a date
the series does not fire on, not evidence the series moves. The walk ended
there with "unproved" and the gate withheld the whole series, so an account
reading a calendar kept in its own zone lost an hour wide band in thirteen
DST zones even though the projection is the identity.
HasUnrepresentableRecurrenceAfterProjection now answers false as soon as
TimeZoneInfo.HasSameRules holds, and the walk skips a wall clock its own zone
removes instead of ending. RFC 5545 section 3.3.5 does define the missing
case, but probing that normalized instant changes no decision for any of the
14,752 zone pairs that could distinguish it, and asserting an expansion
Google does not document would let one guessed date withhold a year.
Also pins what earlier rounds argued: auto-sync refusing to store or notify a
withheld series, JsonIgnore keeping SourceTimeZone off the response body, the
repeated hour needing both of its instants, the probe reaching a full year,
and an all day event logging no dropped end time. A stored SourceTimeZone key
holding a number now reads as no source zone rather than failing the request.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Fix recurring calendar timezone proof and legacy refresh
* Avoid refreshing legacy calendar rows with duplicate event IDs
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Bump FluentAssertions and 23 others (#538)
Bumps FluentAssertions from 8.10.0 to 8.11.0
Bumps Google.Apis.AndroidPublisher.v3 from 1.75.0.4246 to 1.76.0.4277
Bumps Hangfire.AspNetCore from 1.8.24 to 1.8.25
Bumps Hangfire.Core from 1.8.24 to 1.8.25
Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.12
Bumps Microsoft.AspNetCore.OpenApi from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.ApiDescription.Server from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Caching.Abstractions from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Caching.Memory from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.11 to 10.0.12
Bumps Microsoft.Extensions.Http from 10.0.11 to 10.0.12
Bumps Microsoft.IdentityModel.JsonWebTokens from 8.22.0 to 8.23.0
Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1
Bumps OpenAI from 2.13.0 to 2.14.0
Bumps PostHog from 2.14.0 to 2.15.7
Bumps PostHog.AspNetCore from 2.9.0 to 2.9.7
Bumps Scalar.AspNetCore from 2.17.1 to 2.17.9
Bumps Sentry.AspNetCore from 6.9.0 to 6.11.1
Bumps Stripe.net from 52.3.0 to 52.4.2
---
updated-dependencies:
- dependency-name: Google.Apis.AndroidPublisher.v3
dependency-version: 1.76.0.4277
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Hangfire.AspNetCore
dependency-version: 1.8.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Hangfire.Core
dependency-version: 1.8.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Hangfire.Core
dependency-version: 1.8.25
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.Design
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.Relational
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.ApiDescription.Server
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Caching.Abstractions
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Caching.StackExchangeRedis
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Http
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.IdentityModel.JsonWebTokens
dependency-version: 8.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: OpenAI
dependency-version: 2.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: PostHog
dependency-version: 2.15.7
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: PostHog.AspNetCore
dependency-version: 2.9.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Scalar.AspNetCore
dependency-version: 2.17.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Sentry.AspNetCore
dependency-version: 6.11.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Stripe.net
dependency-version: 52.4.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: FluentAssertions
dependency-version: 8.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.Extensions.Caching.Memory
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: FluentAssertions
dependency-version: 8.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: FluentAssertions
dependency-version: 8.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.InMemory
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
dependency-version: 10.0.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: nuget-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Give API key management one authorization concept with two doors (#528)
* Start #529 API key step up
* Require API key management step up
* chore: regenerate the architecture map
The step up change moved the API key endpoints' shape, so `architecture.json`
and `architecture.html` no longer matched the tree and the `drift` check
failed on `git diff --exit-code`. Regenerated with `node tools/arch-map.mjs`,
which reports 45 entities and 0 untested feature folders.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Give API key management one authorization concept with two doors
Listing, creating and revoking API keys now read one grant. Two doors open
it, and both end in a six-digit code emailed to the account owner: the HTTP
challenge, and a verified agent step-up.
Creating key material spends the grant. Listing and revoking only read it,
so one emailed code authorizes a management session instead of exactly one
revoke. A revoke no longer locks the person out of the key list.
get_api_keys gets a door. RequireApiKeyCreationStepUp raises the read
capability to a step-up inside the executor, so the read opens a pending
operation the caller can step up against, and the MCP read routes through
McpExecutorBridge like the mutation does.
AppConfigService now parses a stored row strictly and throws by name when a
row is malformed, so a typo cannot leave the gate off while the read-back
reports it on.
Both controller actions declare 403 and …
thomasluizon
added a commit
that referenced
this pull request
Oct 21, 2026
) * Support entry point intent (#532) (#523) * Open support entry intent work Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrpPfdSqgp5twko5kzTvf8 * Add support entry point intent Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrpPfdSqgp5twko5kzTvf8 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Run CI on redesign pull requests (#524) * chore: initialize #539 pull request * chore: run CI for redesign pull requests * fix: compare mutation scope with pull request base * Add repairable streak gap dates (#518) * chore: initialize ticket 505 * feat: expose repairable streak gap dates * chore(arch): regenerate the architecture map for the repairable gap read Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UFozk1UXf4Pm5spEHYxzT1 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Sync redesign API branch with main for #670 (#556) * Add habit widget empty reason (#527) * Start #372 * Add habit widget empty reason * ORB-223: Generate gating matrix from PayGateService (#520) * chore: start ORB-223 * feat: generate gating matrix * fix: fail closed on unreadable plan gates * fix: close gating matrix parser gaps * fix: preserve plans in combined guards * fix: distinguish quota lifted plans * fix: carry plan provenance through quota aliases Derived quota variables were recorded unscoped and only the variable that literally contains the plan ternary was relabelled afterwards, so plan provenance did not survive a local alias. A semantics-preserving `var selectedLimit = user.HasProAccess ? proLimit : freeLimit; var messageLimit = selectedLimit;` generated cleanly and changed CanSendAiMessage.quotaLiftedByPlan from "Pro" to null. The directly plan-selected variables are now labelled first, and the fixed-point propagation carries the source variable's exact plan instead of null. An assignment deriving from two different plans cannot have its provenance proven, so generation fails closed with the same "cannot derive plan requirement" error the other unprovable shapes use. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: fail closed on unknown gating sources * fix: derive feature flags from migrations --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: fall back to Claude only when the Codex reviewer step fails (#529) Mirrors thomasluizon/orbit-ui-mobile#1022. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Let the executor own the MCP confirmation gate (#599) (#534) * fix: let the executor own the MCP confirmation gate (#599) Every MCP tool whose capability requires a confirmation or a step-up was refused forever. The selective-auth middleware evaluated the policy a second time, in front of the executor, and it never received the caller's confirmation token. A client that stepped up and retried with a valid token got the identical refusal, because the token never reached that evaluation. Carrying the token into the middleware cannot fix it. A confirmation token is single use and is bound to the pending operation's fingerprint, and the middleware computes a different fingerprint from the raw MCP arguments than the executor computes from the operation id and its snake_case argument object. One token cannot satisfy two gates. So the middleware now steps aside for a confirmation-gated capability, the same way it already steps aside for execute_agent_operation_v2. Both reach IAgentOperationExecutor, which evaluates access and confirmation together, holds the token, and writes the audit row. Two guard tests pin the invariants the deferral rests on: a confirmation requirement always sits on a mutation, and every confirmation-gated MCP tool reaches the executor through McpExecutorBridge. Also corrected: the step-up message and the three tool parameter descriptions named verify_step_up_agent_operation_v2 as the source of the confirmation token. It does not return one. confirm_agent_operation_v2 does. Removed AgentPolicyEvaluationContext.StepUpSatisfied. Nothing ever set it and nothing ever read it; the real step-up state lives on PendingAgentOperationState.StepUpSatisfiedAtUtc. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: thread the confirmation token through the bulk habit tools (#599) bulk_log_habits and bulk_skip_habits declared no confirmationToken parameter and their shared helper hardcoded confirmationToken: null, so their HabitsBulkWrite capability (FreshConfirmation) could never see a token and both tools stayed permanently refused. Both now declare the parameter and ExecuteBulkHabitOperationAsync forwards it. Three new guards in ConfirmationGatedMcpToolsRouteThroughExecutorTests pin what the old one missed. The scan now asserts it reaches exactly the catalog's gated MCP tools, that each tool's forwarded operation id resolves to a capability with the same ConfirmationRequirement, and that each tool accepts and forwards a confirmation token. The source scan walks subfolders and keys members by their declaration rather than by the first invocation-shaped token in the chunk. AgentOperationExecutor writes an AgentAuditLogs row before returning UnknownOperation, restoring the trail the middleware used to leave. McpConfirmationGateTests now drives the real AgentTools recovery methods end to end and pins that all three refuse an API-key credential. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: resolve the forwarded MCP confirmation token back to the tool parameter (#599) The token guard whitelisted one spelling of null. It flagged a bridge call only when the confirmation-token argument was absent or the literal `null`, so `confirmationToken: default`, `null!`, `(string?)null` and `""` all passed while the tool stayed refused forever. A longer literal list does not close that, because the next spelling is not on the list either. Assert the structural property instead: a gated tool declares a `string? confirmationToken` parameter, and the expression it forwards into the executor's token slot resolves back to that identifier, directly or through one helper hop. Every other expression fails, whatever it spells. The declaration check now reads the tool's parameter list rather than its whole body, so a local named `confirmationToken` no longer satisfies it. Also add `forwarded.Id == tool.Capability.Id` to the operation-id guard. It compared only the confirmation requirement, so a gated tool could forward another gated capability's operation id, keep confirmation firing, and have the executor enforce the wrong scope. The file's doc comment said four invariants and listed four; the file holds five. Name the source-scan invariant the other three rest on. Six mutations, each red on its own, real tree green at every step: `confirmationToken: default`, `null!`, `(string?)null`, `""`, a gated tool forwarding a different local, and `delete_tag` forwarding `delete_goal`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: strip only a real named-argument prefix in the MCP guard parser (#599) ArgumentAt treated any colon as a named-argument separator, so a conditional expression in the token slot or the operation-id slot collapsed to its else-branch. `ids.Count > 0 ? null : confirmationToken` read as `confirmationToken` and `tagId.Length > 0 ? "delete_goal" : "delete_tag"` read as `"delete_tag"`, and both guards stayed green over the restored defect. Match `^\w+\s*:(?!:)` instead, so only a leading `name:` prefix is stripped and every other expression reaches the resolver whole. The anchor keeps a colon inside a string literal and a `::` qualifier from matching. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: separate an omitted caller argument from a non-parameter expression (#599) ResolveExpression returned the expression itself both when it was not a callee parameter and when the caller supplied nothing at that index. The second case handed back the helper's own parameter name, which then compared equal to `confirmationToken` and passed. Giving the helper an optional `string? confirmationToken = null` and calling it without that argument restored the #599 defect with the guard green. Return the `<omitted>` sentinel for the second case instead. It can never equal the parameter name, and it resolves to no capability in the operation-id slot, so both guards fail closed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: read a gated tool's direct and helper bridge calls together (#599) CollectBridgeCalls returned early as soon as the tool body held one bridge call, so a correct call in a dead branch hid every helper call in the same tool. A decoy `if (tagId.Length == 0)` block forwarding `confirmationToken` plus a same-file helper forwarding `null` restored the #599 defect with the guard green. Collect both sets instead. Every bridge call a gated tool can reach, directly or through one helper hop, now has to forward the parameter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: refuse a gated tool that assigns to its own confirmationToken (#599) The rule compared the forwarded expression's text only, so `confirmationToken = null;` above the bridge call restored the #599 defect with the forwarded identifier unchanged and the guard green. Add an offender when the tool body, or a same-file helper it reaches, assigns to the parameter. MemberSource now carries its statements with the parameter list excluded, so the declaration's own `string? confirmationToken = null` default does not match. The pattern `\bconfirmationToken\s*=[^=>]` leaves `==`, `!=`, `>=`, `<=`, `??=` and a lambda arrow alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: say what the MCP token resolver models, not more (#599) Invariant 5 claimed "any other expression in the token slot refuses the tool forever" and that the tool forwards the identifier "directly or through a helper it calls". A conditional refuses the tool on some paths only, and the resolver models exactly one same-file helper hop matched by argument position. Replace both sentences with what the scan actually does, and state its limits: two or more hops read as no bridge call and fail the routing guard, and aliasing, reflection and an interface call are outside the model. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: catch a compound assignment to confirmationToken (#599) The assignment rule was anchored on `\s*=`, and `\s*` cannot cross the `??` of `??=` or the `+` of `+=`. So `confirmationToken ??= tagId;` above the bridge call compiled green with all five guards green, and a later change that writes `confirmationToken ??= await ResolveStoredTokenAsync(...)` would hand the executor a token the MCP caller never sent: HasFreshConfirmation is then satisfied from state the caller does not control, while the middleware has already stepped aside. Admit the two compound operators a `string?` can carry. `==` still fails on the second `=`, `!=`, `>=` and `<=` still fail because those characters break `\s*` and are not in the alternation, `=>` still fails on the trailing character class, and a bare `??` with no `=` still fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: read every same-named helper an MCP tool could be calling (#599) The member index was a dictionary keyed on the bare name and built with group.First(), so two same-named members collapsed to whichever was declared first. The scan then analysed a method the tool never calls. It broke both ways: a decoy overload declared after the real helper and forwarding null was green, and a gated tool calling a correct overload reddened when an unrelated same-named member happened to be declared first. Hold every member under its name and, at each call site, read every candidate whose parameter count can admit that many arguments. One candidate resolves the call; more than one is ambiguous, so all of them are read and any bad one reddens the tool. That fails closed instead of guessing, and it costs no false red in the case above, where only the real helper carries a bridge call. A name that admits no candidate stays unresolved, which hides nothing: the bridge call inside it is not collected either, so the routing guard reddens the tool. Arity, not the parameter type, is what decides a candidate. The scan is a text scan, so it cannot type-check an argument. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: say what invariant 5 now refuses and what it still cannot see (#599) The general claim "refuses a tool that assigns to the parameter" is now exact: `=`, `??=` and `+=`. The helper hop no longer claims a "matching argument position", because the resolver pairs by position alone and strips a named-argument prefix without reading the name, so arguments named out of the declared order are read wrong. The comment said nothing about overloads, so say that an ambiguous name is read as every candidate and reddens the tool. Close with the honest limit: a text scan is defeatable by an author who sets out to defeat it, and what the guard closes is every shape an ordinary refactor produces. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Fix calendar event timezone projection (#521) * Start calendar timezone fix * Fix calendar event timezone projection * Fix projected calendar end times * Fix calendar end time during DST fallback * Fix calendar end time minute precision * Fix projected calendar recurrence rule * Guard calendar recurrence across timezone shifts * Project calendar recurrence weekdays * Keep calendar recurrence unchanged * Omit unrepresentable recurring calendar events * Gate projected calendar recurrence on the whole fetch window Closes the six review findings on pull request 521. 1. The weekday gate now walks every expanded occurrence Google returned for a recurring master, not the one sampled instance. The fetcher collects each instance start with the source calendar's own offset into a JsonIgnore'd ExpandedOccurrences list, so a Lisbon BYDAY=TH series that is stable in January and shifts to Wednesday in July is refused. The empty list still falls back to the sampled instance for an all-day series and for a suggestion row read back from the database. 2. The legacy title plus date plus time key only excludes a suggestion when exactly one candidate carries it. Inside a fall-back repeated hour two events project to the same local time, so the key proves nothing and both stay. This mirrors the group.Count() == 1 guard the auto sync reconciler already applies to the same key. 3. An omitted end time now logs its reason at Debug with the event id and the user id. EndUtc already ships the real duration, so the client keeps it. 4. The refusal here and the clamp in HabitScheduleService.IsMonthlyMatch are reconciled in a doc comment: Orbit clamps a rule it owns and refuses a rule it imports and cannot re-express without inventing a weekday. 5. Both new call sites pass the logger and the user id to FindTimeZone, which also catches InvalidTimeZoneException so a corrupt zone stops escaping as a 500. User.SetTimeZone trims at the boundary and rejects a blank id. 6. Asia/Kathmandu at plus 05:45 and Pacific/Chatham at plus 12:45 cover the sub hour offset gap. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Prove calendar recurrence stability from both zones Round 6 gated a BYDAY series on the expanded instances Google returned, and GoogleCalendarApi only asks for sixty days, so a series whose transition falls outside that window was admitted and a stored suggestion row never carried the instances at all. The gate now reads the source calendar's own timezone from the recurring master the fetcher already fetches, and walks a year of dates at the occurrence's source wall clock through both zones' rules. A series it cannot prove stable is withheld from both feeds. StoredCalendarEventJson carries the source zone beside the stored suggestion, so the suggestion feed judges a row on the same evidence the events feed had. Also in scope: the auto-sync reconciler projects a fetched event into the account timezone before matching a legacy habit, the end-time omission logs whatever EndUtc holds, and an all-day event no longer reports Google's exclusive end date as an end instant. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Keep calendar series a spring forward gap cannot move A probe date whose source wall clock a spring forward gap removes is a date the series does not fire on, not evidence the series moves. The walk ended there with "unproved" and the gate withheld the whole series, so an account reading a calendar kept in its own zone lost an hour wide band in thirteen DST zones even though the projection is the identity. HasUnrepresentableRecurrenceAfterProjection now answers false as soon as TimeZoneInfo.HasSameRules holds, and the walk skips a wall clock its own zone removes instead of ending. RFC 5545 section 3.3.5 does define the missing case, but probing that normalized instant changes no decision for any of the 14,752 zone pairs that could distinguish it, and asserting an expansion Google does not document would let one guessed date withhold a year. Also pins what earlier rounds argued: auto-sync refusing to store or notify a withheld series, JsonIgnore keeping SourceTimeZone off the response body, the repeated hour needing both of its instants, the probe reaching a full year, and an all day event logging no dropped end time. A stored SourceTimeZone key holding a number now reads as no source zone rather than failing the request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Fix recurring calendar timezone proof and legacy refresh * Avoid refreshing legacy calendar rows with duplicate event IDs --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Bump FluentAssertions and 23 others (#538) Bumps FluentAssertions from 8.10.0 to 8.11.0 Bumps Google.Apis.AndroidPublisher.v3 from 1.75.0.4246 to 1.76.0.4277 Bumps Hangfire.AspNetCore from 1.8.24 to 1.8.25 Bumps Hangfire.Core from 1.8.24 to 1.8.25 Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.12 Bumps Microsoft.AspNetCore.OpenApi from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.ApiDescription.Server from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Caching.Abstractions from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Caching.Memory from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Http from 10.0.11 to 10.0.12 Bumps Microsoft.IdentityModel.JsonWebTokens from 8.22.0 to 8.23.0 Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1 Bumps OpenAI from 2.13.0 to 2.14.0 Bumps PostHog from 2.14.0 to 2.15.7 Bumps PostHog.AspNetCore from 2.9.0 to 2.9.7 Bumps Scalar.AspNetCore from 2.17.1 to 2.17.9 Bumps Sentry.AspNetCore from 6.9.0 to 6.11.1 Bumps Stripe.net from 52.3.0 to 52.4.2 --- updated-dependencies: - dependency-name: Google.Apis.AndroidPublisher.v3 dependency-version: 1.76.0.4277 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Hangfire.AspNetCore dependency-version: 1.8.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Hangfire.Core dependency-version: 1.8.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Hangfire.Core dependency-version: 1.8.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Relational dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.ApiDescription.Server dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.Abstractions dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.StackExchangeRedis dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Http dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.IdentityModel.JsonWebTokens dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: OpenAI dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: PostHog dependency-version: 2.15.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: PostHog.AspNetCore dependency-version: 2.9.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Scalar.AspNetCore dependency-version: 2.17.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Sentry.AspNetCore dependency-version: 6.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Stripe.net dependency-version: 52.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.InMemory dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.Memory dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.InMemory dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Give API key management one authorization concept with two doors (#528) * Start #529 API key step up * Require API key management step up * chore: regenerate the architecture map The step up change moved the API key endpoints' shape, so `architecture.json` and `architecture.html` no longer matched the tree and the `drift` check failed on `git diff --exit-code`. Regenerated with `node tools/arch-map.mjs`, which reports 45 entities and 0 untested feature folders. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Give API key management one authorization concept with two doors Listing, creating and revoking API keys now read one grant. Two doors open it, and both end in a six-digit code emailed to the account owner: the HTTP challenge, and a verified agent step-up. Creating key material spends the grant. Listing and revoking only read it, so one emailed code authorizes a management session instead of exactly one revoke. A revoke no longer locks the person out of the key list. get_api_keys gets a door. RequireApiKeyCreationStepUp raises the read capability to a step-up inside the executor, so the read opens a pending operation the caller can step up against, and the MCP read routes through McpExecutorBridge like the mutation does. AppConfigService now parses a stored row strictly and throws by name when a row is malformed, so a typo cannot leave the gate off while the read-back reports it on. Both controller actions declare 403 and 428, and openapi.json carries them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Cover API key step up through merged MCP gate --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Expose habit emoji in MCP tools (#513) (#546) * Open ticket 513 implementation review * Expose habit emoji across MCP tools (#513) * Prevent stale pull request workflow runs for #659 (#555) * Start #659 workflow concurrency change * Group core PR workflows by pull request for #659 * Group remaining PR workflows by pull request for #659 * Fix #657 logout revocation across a session family (#553) * Start #657 session family fix * Revoke the full auth session after logout (#657) * Explain temporary legacy token allowance (#657) * Handle duplicate refresh history race (#657) * Fix #588 bulk habit interval weeks (#539) * Start #588 bulk interval weeks fix * Fix #588 bulk habit interval weeks mapping * Guarantee crisis resources in Astra chat for #319 (#547) * Add crisis guidance to Astra static prompt for #319 * Add curated crisis detection and regression cases for #319 * Wire crisis guard across chat delivery and metrics for #319 * Refine crisis delivery and cover fallback regression for #319 * Return static crisis support when AI chat fails for #319 * Keep crisis FAQ regression isolated for #319 * Fix crisis replies to bypass AI quota and provider * Record streak freeze source for #571 (#540) * Start #571 freeze source work * Record streak freeze origin for #571 * Require explicit origin for new streak freezes * Keep support tool available for support entry point (#541) * Expose scheduled streak repair gap dates for #505 (#542) * Fix standalone sub habit title validation for #628 (#543) * Start #628 sub habit title validation fix * Use sub habit title messages in standalone validation (#628) * Carry the onboarding repeat interval into the created habit (#596) (#533) A signed-out person who set a weekly repeat interval during onboarding lost it at sign-up. ApplyHabitInput carried no interval field at all, so the apply path dropped the value between the screen and the record. Add an optional IntervalWeeks to ApplyHabitInput, additive only, and pass it to Habit.Create alongside the other schedule options. No existing field changes name, shape or nullability, so a client that sends nothing keeps the behaviour it has today: IntervalWeeks stays null and the habit repeats every week. Validate the new field with the shared SharedHabitRules.AddIntervalWeeksRules range, the same 1 to 52 bound every other create path uses. Regenerate openapi.json and architecture.json/html for the new field and for the test class that now touches HabitScheduleService. Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Expose recurrence time zone in calendar events for #591 (#544) * Start #591 recurrence time zone work * Expose recurring calendar event time zone for #591 * Restore recurrence time zone in legacy suggestions for #591 * Project safe calendar BYDAY recurrences (#569) (#545) * Start calendar BYDAY projection (#569) * Project uniform calendar BYDAY recurrences (#569) * Cover alternate week recurrence projection (#569) * Keep shifted calendar rules importable by installed clients * Add closed week and year recap ranges for #369 (#548) * Fix Google sign-in after concurrent user updates (#551) * chore: start ticket 324 review * fix: retry concurrent Google sign-in updates (#324) * Fix duplicate agent confirmation consumption (#557) * Start fix for ticket 671 confirmation race * Claim agent confirmation once under concurrent saves * chore: regenerate the architecture map for the confirmation claim migration (#671) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix: show newest habit completion date in profile (#549) * chore: start ticket 391 * fix: expose latest habit completion date in profile * fix: exclude bad habit slips from last completion date * fix: pass the freeze origin in the profile freeze test after #540 (#391) The merge with main brought StreakFreeze.Create's required origin parameter (#540). The test now asserts that a freeze without a completion leaves lastCompletionDate null for both origins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: preserve last completion across habit cleanup (#391) * Preserve descendant completions during sync cleanup --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix: resolve stored recap week anchors without the current preference A closed week anchor lives in the recap share link and in the stored snapshot key. Validating it against today's WeekStartDay rejected a Monday anchor after the person moved to Sunday, before the stored snapshot could be read. Accept any supported week start (Sunday or Monday) for an explicit closed anchor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Redesign the transactional emails, AI push copy and error messages (R20) (#532) * Add habit widget empty reason (#527) * Start #372 * Add habit widget empty reason * ORB-223: Generate gating matrix from PayGateService (#520) * chore: start ORB-223 * feat: generate gating matrix * fix: fail closed on unreadable plan gates * fix: close gating matrix parser gaps * fix: preserve plans in combined guards * fix: distinguish quota lifted plans * fix: carry plan provenance through quota aliases Derived quota variables were recorded unscoped and only the variable that literally contains the plan ternary was relabelled afterwards, so plan provenance did not survive a local alias. A semantics-preserving `var selectedLimit = user.HasProAccess ? proLimit : freeLimit; var messageLimit = selectedLimit;` generated cleanly and changed CanSendAiMessage.quotaLiftedByPlan from "Pro" to null. The directly plan-selected variables are now labelled first, and the fixed-point propagation carries the source variable's exact plan instead of null. An assignment deriving from two different plans cannot have its provenance proven, so generation fails closed with the same "cannot derive plan requirement" error the other unprovable shapes use. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: fail closed on unknown gating sources * fix: derive feature flags from migrations --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: fall back to Claude only when the Codex reviewer step fails (#529) Mirrors thomasluizon/orbit-ui-mobile#1022. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * Redesign the transactional emails, AI push copy and error messages Closes thomasluizon/orbit-tickets#75 (R20). Emails. All 7 types plus the shared wrapper move to the granted canon: the violet #7F46F7 becomes the warm orange #C4530F, the gradient header band and every CTA glow are gone (DESIGN.md bans both), Rubik and Inter become the Geist Sans and Geist Mono stacks, and the planet emoji and sparkle bullets give way to the mark and a plain numbered list. Emails now author light and override dark through prefers-color-scheme, which matches "light mode MANDATORY, dark primary" and survives a forced inversion far better than the dark only document did. Copy is rewritten in both languages to say what happened before what to do next. Support copy moves out of its template into EmailCopy so markup holds no strings. AI push copy. The slip alert, proactive check in and daily summary prompts demonstrated an exclamation mark and a doubled hyphen inside their own worked examples, and at temperature 0.9 the model reproduced both. One shared voice contract, NotificationVoice, now states each ban and carries no example at all. The fallback strings carried the same two tells and are rewritten. Error messages. A domain guard firing is an ordinary event, but its message is the sentence a developer wrote, and on 2026-08-05 a tester read "Days can only be set when frequency quantity is 1." verbatim, in English, inside a pt-BR interface. ErrorCopy now maps every error code to user facing copy in both languages, and one result filter swaps the message at the response boundary. DomainErrors stays developer facing, as the ticket requires. The catalog is total over ErrorCodes, ErrorMessages and DomainErrors, and a reflection test fails the build when a constant arrives without copy, so the raw message fallback is unreachable. ErrorMessages now takes its English from the same catalog rather than repeating 145 sentences in a second file. AppError and Result carry the arguments behind a {0} placeholder so the localized template can be formatted with the same values, which the eagerly formatted message alone no longer exposed. Also removed: five pay gate strings ending in "Upgrade to unlock!", a banned word and an exclamation on a sell; inlined copies of error sentences in three chat tools; and a hardcoded 500 envelope message. Tests: 6980 passing, 0 failing. Line coverage 86.40%. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Build the banned dashes from code points and refresh the architecture map Two red checks on PR 532 at c50f052e. Dash Ban. The three new voice tests detected a banned dash by embedding one, and the gate scans a test file like any other. The two constants are now built from their code points, ((char)0x2014) and ((char)0x2013), so no literal character sits in the source. The escape form these files were written with did not survive: the lefthook pre-commit step runs dotnet format, which normalized "—" back into the raw character before the commit landed. A code point arithmetic expression has no literal for a formatter to normalize. The assertions are unchanged. Verified by injecting a real em dash into one ErrorCopy entry and one EmailCopy string: EveryEntryObeysTheErrorVoice and NoEmailStringCarriesADashCharacter both went red, then green again once the injection was reverted. drift. architecture.json and architecture.html were stale against the new test classes and the changed file counts. Regenerated with node tools/arch-map.mjs and committed here, in the change that requires them. The generator is deterministic: two consecutive runs are byte identical. tools/dash-baseline.json is untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix the four blocking findings on the email and error copy pass C1: the deletion email promised a permanent wipe while the product only deactivates. The intro now states the grace window, read from AppConstants.MaxDeletionGraceDays, and that signing in again cancels it. C2: the copy pass had moved the wrong-code failure onto a new error code both shipped clients have no branch for, which sends Orbit 1.3.31 and the web step-up screen to a generic error. The code returns to INVALID_VERIFICATION_CODE, and the count rides in a counted copy variant that keeps the trailing token those clients parse. C3: the reply language came from Accept-Language alone, which neither the Android app nor the web Server Actions send, so every signed-in pt-BR reader got English. RequestLanguageResolver reads the stored User.Language first and keeps the header as the anonymous fallback. The header parse now honours quality values. C4: the slip alert claimed the usual time had arrived, while the scheduler sends two hours early and at 08:00 when no peak hour exists. The prompt states when the push lands and the fallback makes no time claim without a peak hour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Make the copy claims match the code that produces them C5: the check-in fallback called one open habit "a few" and promised that Astra records the rest. The scheduler sends as soon as one habit is off track, and LogHabitTool records only the habit a person names. C6: the 429 body was an anonymous object the localizing filter could not match, so the RATE_LIMITED copy was unreachable. It is built from ErrorMessages.TooManyRequests now, which also gives the 429 an error code for the first time. Retry-After and the request id already ride in headers. C8: the sync copy promised a reload and a later send that no caller performs. C9: a challenge does not take part, people do. C10: the recap arrives only for a reader with a push subscription, so the copy points at coming back instead. D1 and D4: two doc comments claimed more than the code does. The filter covers ErrorResponse bodies only, and a FluentValidation message never reaches it. A missing catalog entry throws on the first request, not at startup. D3: BuildSummaryPrompt is internal and joins both voice theory sources, so the guard written for its doubled-hyphen leak now reaches it. D5: AppError compared Args by reference, so two errors formatted with the same count came out unequal. Equality walks the arguments now. The three voice tests that read NotificationVoice.Rules' own literals back out of it now assert the bans over every prompt a model receives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Refresh the architecture map for the review round Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Let the executor own the MCP confirmation gate (#599) (#534) * fix: let the executor own the MCP confirmation gate (#599) Every MCP tool whose capability requires a confirmation or a step-up was refused forever. The selective-auth middleware evaluated the policy a second time, in front of the executor, and it never received the caller's confirmation token. A client that stepped up and retried with a valid token got the identical refusal, because the token never reached that evaluation. Carrying the token into the middleware cannot fix it. A confirmation token is single use and is bound to the pending operation's fingerprint, and the middleware computes a different fingerprint from the raw MCP arguments than the executor computes from the operation id and its snake_case argument object. One token cannot satisfy two gates. So the middleware now steps aside for a confirmation-gated capability, the same way it already steps aside for execute_agent_operation_v2. Both reach IAgentOperationExecutor, which evaluates access and confirmation together, holds the token, and writes the audit row. Two guard tests pin the invariants the deferral rests on: a confirmation requirement always sits on a mutation, and every confirmation-gated MCP tool reaches the executor through McpExecutorBridge. Also corrected: the step-up message and the three tool parameter descriptions named verify_step_up_agent_operation_v2 as the source of the confirmation token. It does not return one. confirm_agent_operation_v2 does. Removed AgentPolicyEvaluationContext.StepUpSatisfied. Nothing ever set it and nothing ever read it; the real step-up state lives on PendingAgentOperationState.StepUpSatisfiedAtUtc. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: thread the confirmation token through the bulk habit tools (#599) bulk_log_habits and bulk_skip_habits declared no confirmationToken parameter and their shared helper hardcoded confirmationToken: null, so their HabitsBulkWrite capability (FreshConfirmation) could never see a token and both tools stayed permanently refused. Both now declare the parameter and ExecuteBulkHabitOperationAsync forwards it. Three new guards in ConfirmationGatedMcpToolsRouteThroughExecutorTests pin what the old one missed. The scan now asserts it reaches exactly the catalog's gated MCP tools, that each tool's forwarded operation id resolves to a capability with the same ConfirmationRequirement, and that each tool accepts and forwards a confirmation token. The source scan walks subfolders and keys members by their declaration rather than by the first invocation-shaped token in the chunk. AgentOperationExecutor writes an AgentAuditLogs row before returning UnknownOperation, restoring the trail the middleware used to leave. McpConfirmationGateTests now drives the real AgentTools recovery methods end to end and pins that all three refuse an API-key credential. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: resolve the forwarded MCP confirmation token back to the tool parameter (#599) The token guard whitelisted one spelling of null. It flagged a bridge call only when the confirmation-token argument was absent or the literal `null`, so `confirmationToken: default`, `null!`, `(string?)null` and `""` all passed while the tool stayed refused forever. A longer literal list does not close that, because the next spelling is not on the list either. Assert the structural property instead: a gated tool declares a `string? confirmationToken` parameter, and the expression it forwards into the executor's token slot resolves back to that identifier, directly or through one helper hop. Every other expression fails, whatever it spells. The declaration check now reads the tool's parameter list rather than its whole body, so a local named `confirmationToken` no longer satisfies it. Also add `forwarded.Id == tool.Capability.Id` to the operation-id guard. It compared only the confirmation requirement, so a gated tool could forward another gated capability's operation id, keep confirmation firing, and have the executor enforce the wrong scope. The file's doc comment said four invariants and listed four; the file holds five. Name the source-scan invariant the other three rest on. Six mutations, each red on its own, real tree green at every step: `confirmationToken: default`, `null!`, `(string?)null`, `""`, a gated tool forwarding a different local, and `delete_tag` forwarding `delete_goal`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: strip only a real named-argument prefix in the MCP guard parser (#599) ArgumentAt treated any colon as a named-argument separator, so a conditional expression in the token slot or the operation-id slot collapsed to its else-branch. `ids.Count > 0 ? null : confirmationToken` read as `confirmationToken` and `tagId.Length > 0 ? "delete_goal" : "delete_tag"` read as `"delete_tag"`, and both guards stayed green over the restored defect. Match `^\w+\s*:(?!:)` instead, so only a leading `name:` prefix is stripped and every other expression reaches the resolver whole. The anchor keeps a colon inside a string literal and a `::` qualifier from matching. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: separate an omitted caller argument from a non-parameter expression (#599) ResolveExpression returned the expression itself both when it was not a callee parameter and when the caller supplied nothing at that index. The second case handed back the helper's own parameter name, which then compared equal to `confirmationToken` and passed. Giving the helper an optional `string? confirmationToken = null` and calling it without that argument restored the #599 defect with the guard green. Return the `<omitted>` sentinel for the second case instead. It can never equal the parameter name, and it resolves to no capability in the operation-id slot, so both guards fail closed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: read a gated tool's direct and helper bridge calls together (#599) CollectBridgeCalls returned early as soon as the tool body held one bridge call, so a correct call in a dead branch hid every helper call in the same tool. A decoy `if (tagId.Length == 0)` block forwarding `confirmationToken` plus a same-file helper forwarding `null` restored the #599 defect with the guard green. Collect both sets instead. Every bridge call a gated tool can reach, directly or through one helper hop, now has to forward the parameter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: refuse a gated tool that assigns to its own confirmationToken (#599) The rule compared the forwarded expression's text only, so `confirmationToken = null;` above the bridge call restored the #599 defect with the forwarded identifier unchanged and the guard green. Add an offender when the tool body, or a same-file helper it reaches, assigns to the parameter. MemberSource now carries its statements with the parameter list excluded, so the declaration's own `string? confirmationToken = null` default does not match. The pattern `\bconfirmationToken\s*=[^=>]` leaves `==`, `!=`, `>=`, `<=`, `??=` and a lambda arrow alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: say what the MCP token resolver models, not more (#599) Invariant 5 claimed "any other expression in the token slot refuses the tool forever" and that the tool forwards the identifier "directly or through a helper it calls". A conditional refuses the tool on some paths only, and the resolver models exactly one same-file helper hop matched by argument position. Replace both sentences with what the scan actually does, and state its limits: two or more hops read as no bridge call and fail the routing guard, and aliasing, reflection and an interface call are outside the model. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: catch a compound assignment to confirmationToken (#599) The assignment rule was anchored on `\s*=`, and `\s*` cannot cross the `??` of `??=` or the `+` of `+=`. So `confirmationToken ??= tagId;` above the bridge call compiled green with all five guards green, and a later change that writes `confirmationToken ??= await ResolveStoredTokenAsync(...)` would hand the executor a token the MCP caller never sent: HasFreshConfirmation is then satisfied from state the caller does not control, while the middleware has already stepped aside. Admit the two compound operators a `string?` can carry. `==` still fails on the second `=`, `!=`, `>=` and `<=` still fail because those characters break `\s*` and are not in the alternation, `=>` still fails on the trailing character class, and a bare `??` with no `=` still fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix: read every same-named helper an MCP tool could be calling (#599) The member index was a dictionary keyed on the bare name and built with group.First(), so two same-named members collapsed to whichever was declared first. The scan then analysed a method the tool never calls. It broke both ways: a decoy overload declared after the real helper and forwarding null was green, and a gated tool calling a correct overload reddened when an unrelated same-named member happened to be declared first. Hold every member under its name and, at each call site, read every candidate whose parameter count can admit that many arguments. One candidate resolves the call; more than one is ambiguous, so all of them are read and any bad one reddens the tool. That fails closed instead of guessing, and it costs no false red in the case above, where only the real helper carries a bridge call. A name that admits no candidate stays unresolved, which hides nothing: the bridge call inside it is not collected either, so the routing guard reddens the tool. Arity, not the parameter type, is what decides a candidate. The scan is a text scan, so it cannot type-check an argument. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs: say what invariant 5 now refuses and what it still cannot see (#599) The general claim "refuses a tool that assigns to the parameter" is now exact: `=`, `??=` and `+=`. The helper hop no longer claims a "matching argument position", because the resolver pairs by position alone and strips a named-argument prefix without reading the name, so arguments named out of the declared order are read wrong. The comment said nothing about overloads, so say that an ambiguous name is read as every candidate and reddens the tool. Close with the honest limit: a text scan is defeatable by an author who sets out to defeat it, and what the guard closes is every shape an ordinary refactor produces. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Fix calendar event timezone projection (#521) * Start calendar timezone fix * Fix calendar event timezone projection * Fix projected calendar end times * Fix calendar end time during DST fallback * Fix calendar end time minute precision * Fix projected calendar recurrence rule * Guard calendar recurrence across timezone shifts * Project calendar recurrence weekdays * Keep calendar recurrence unchanged * Omit unrepresentable recurring calendar events * Gate projected calendar recurrence on the whole fetch window Closes the six review findings on pull request 521. 1. The weekday gate now walks every expanded occurrence Google returned for a recurring master, not the one sampled instance. The fetcher collects each instance start with the source calendar's own offset into a JsonIgnore'd ExpandedOccurrences list, so a Lisbon BYDAY=TH series that is stable in January and shifts to Wednesday in July is refused. The empty list still falls back to the sampled instance for an all-day series and for a suggestion row read back from the database. 2. The legacy title plus date plus time key only excludes a suggestion when exactly one candidate carries it. Inside a fall-back repeated hour two events project to the same local time, so the key proves nothing and both stay. This mirrors the group.Count() == 1 guard the auto sync reconciler already applies to the same key. 3. An omitted end time now logs its reason at Debug with the event id and the user id. EndUtc already ships the real duration, so the client keeps it. 4. The refusal here and the clamp in HabitScheduleService.IsMonthlyMatch are reconciled in a doc comment: Orbit clamps a rule it owns and refuses a rule it imports and cannot re-express without inventing a weekday. 5. Both new call sites pass the logger and the user id to FindTimeZone, which also catches InvalidTimeZoneException so a corrupt zone stops escaping as a 500. User.SetTimeZone trims at the boundary and rejects a blank id. 6. Asia/Kathmandu at plus 05:45 and Pacific/Chatham at plus 12:45 cover the sub hour offset gap. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Prove calendar recurrence stability from both zones Round 6 gated a BYDAY series on the expanded instances Google returned, and GoogleCalendarApi only asks for sixty days, so a series whose transition falls outside that window was admitted and a stored suggestion row never carried the instances at all. The gate now reads the source calendar's own timezone from the recurring master the fetcher already fetches, and walks a year of dates at the occurrence's source wall clock through both zones' rules. A series it cannot prove stable is withheld from both feeds. StoredCalendarEventJson carries the source zone beside the stored suggestion, so the suggestion feed judges a row on the same evidence the events feed had. Also in scope: the auto-sync reconciler projects a fetched event into the account timezone before matching a legacy habit, the end-time omission logs whatever EndUtc holds, and an all-day event no longer reports Google's exclusive end date as an end instant. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Keep calendar series a spring forward gap cannot move A probe date whose source wall clock a spring forward gap removes is a date the series does not fire on, not evidence the series moves. The walk ended there with "unproved" and the gate withheld the whole series, so an account reading a calendar kept in its own zone lost an hour wide band in thirteen DST zones even though the projection is the identity. HasUnrepresentableRecurrenceAfterProjection now answers false as soon as TimeZoneInfo.HasSameRules holds, and the walk skips a wall clock its own zone removes instead of ending. RFC 5545 section 3.3.5 does define the missing case, but probing that normalized instant changes no decision for any of the 14,752 zone pairs that could distinguish it, and asserting an expansion Google does not document would let one guessed date withhold a year. Also pins what earlier rounds argued: auto-sync refusing to store or notify a withheld series, JsonIgnore keeping SourceTimeZone off the response body, the repeated hour needing both of its instants, the probe reaching a full year, and an all day event logging no dropped end time. A stored SourceTimeZone key holding a number now reads as no source zone rather than failing the request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Fix recurring calendar timezone proof and legacy refresh * Avoid refreshing legacy calendar rows with duplicate event IDs --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> * Bump FluentAssertions and 23 others (#538) Bumps FluentAssertions from 8.10.0 to 8.11.0 Bumps Google.Apis.AndroidPublisher.v3 from 1.75.0.4246 to 1.76.0.4277 Bumps Hangfire.AspNetCore from 1.8.24 to 1.8.25 Bumps Hangfire.Core from 1.8.24 to 1.8.25 Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.11 to 10.0.12 Bumps Microsoft.AspNetCore.OpenApi from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.11 to 10.0.12 Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.ApiDescription.Server from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Caching.Abstractions from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Caching.Memory from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Caching.StackExchangeRedis from 10.0.11 to 10.0.12 Bumps Microsoft.Extensions.Http from 10.0.11 to 10.0.12 Bumps Microsoft.IdentityModel.JsonWebTokens from 8.22.0 to 8.23.0 Bumps Microsoft.NET.Test.Sdk from 18.9.0 to 18.10.1 Bumps OpenAI from 2.13.0 to 2.14.0 Bumps PostHog from 2.14.0 to 2.15.7 Bumps PostHog.AspNetCore from 2.9.0 to 2.9.7 Bumps Scalar.AspNetCore from 2.17.1 to 2.17.9 Bumps Sentry.AspNetCore from 6.9.0 to 6.11.1 Bumps Stripe.net from 52.3.0 to 52.4.2 --- updated-dependencies: - dependency-name: Google.Apis.AndroidPublisher.v3 dependency-version: 1.76.0.4277 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Hangfire.AspNetCore dependency-version: 1.8.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Hangfire.Core dependency-version: 1.8.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Hangfire.Core dependency-version: 1.8.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Relational dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.ApiDescription.Server dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.Abstractions dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.StackExchangeRedis dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Http dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.IdentityModel.JsonWebTokens dependency-version: 8.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: OpenAI dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: PostHog dependency-version: 2.15.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: PostHog.AspNetCore dependency-version: 2.9.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Scalar.AspNetCore dependency-version: 2.17.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Sentry.AspNetCore dependency-version: 6.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Stripe.net dependency-version: 52.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.InMemory dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.Extensions.Caching.Memory dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: FluentAssertions dependency-version: 8.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.InMemory dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.EntityFrameworkCore.Sqlite dependency-version: 10.0.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Give API key management one authorization concept with two doors (#528) * Start #529 API key step up * Require API key management step up * chore: regenerate the architecture map The step up change moved the API key endpoints' shape, so `architecture.json` and `architecture.html` no longer matched the tree and the `drift` check failed on `git diff --exit-code`. Regenerated with `node tools/arch-map.mjs`, which reports 45 entities and 0 untested feature folders. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Give API key management one authorization concept with two doors Listing, creating and revoking API keys now read one grant. Two doors open it, and both end in a six-digit code emailed to the account owner: the HTTP challenge, and a verified agent step-up. Creating key material spends the grant. Listing and revoking only read it, so one emailed code authorizes a management session instead of exactly one revoke. A revoke no longer locks the person out of the key list. get_api_keys gets a door. RequireApiKeyCreationStepUp raises the read capability to a step-up inside the executor, so the read opens a pending operation the caller can step up against, and the MCP read routes through McpExecutorBridge like the mutation does. AppConfigService now parses a stored row strictly and throws by name when a row is malformed, so a typo cannot leave the gate off while the read-back reports it on. Both controller acti…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Flexible and completed sub-habits have empty
Instances, so the calendar could not identify their logged days.GetCalendarMonthQuery.csnow includes every loaded habit ID, including descendants, in the existingLogsdictionary. This reuses the existing log DTO and range filtering without changing schedule mapping or existing top-level entries. Old clients can continue reading only top-level IDs.GetCalendarMonthQueryHandlerTests.cscovers flexible, completed one-time, and completed recurring children and grandchildren. Recurring fixtures complete through real domain logging, then move their due date back throughHabit.Updatewhile retaining completion. Tests also preserve exact log fields, descending order, inclusive range boundaries, and zero-valued skip entries. No DTO fields, routes, validators, domain rules, database schema, or minimum client version change.Closes thomasluizon/orbit-tickets#984. The consumer change remains in its blocked UI ticket #985.
Test evidence
Command for each regression observation:
dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~GetCalendarMonthQueryHandlerTests.Handle_LoggedChild_KeepsParentInMonth.Handle_LoggedChild_KeepsParentInMonthfailed at the new descendant dictionary-key assertion. All six cases ofHandle_LoggedFlexibleOrCompletedDescendant_ReturnsExactLogsfailed because their descendant ID was missing, after asserting the real completed/flexible state and empty instances.Handle_DescendantLogs_PreservesRangeOrderingAndTopLevelLogsfailed because the child dictionary key was missing.dotnet build Orbit.slnx: passed with zero errors; existing dependency and obsolete API warnings remain.dotnet test: passed all 7,033 tests with zero failures and zero skips (Application 3,746; Domain 640; Infrastructure 2,615; Analyzers 32).