Repository navigation
Conversation
adenarc
self-requested a review
October 24, 2026 13:22
adenarc
reviewed
Oct 24, 2026
adenarc
left a comment
adenarc
left a comment
Collaborator
There was a problem hiding this comment.
Ran changeset status on the head and it passes. Every target left (ui, api, auth-ui, proposals-plugin, registry-plugin) is in the workspace. The auth-ui retargets look right: the pairing/device pages, "Your profile" and the onboard done screen all live in plugins/auth-ui. Cutting the test-ID sentence is correct too, since those ids are still device.*. None of the other open PRs' changesets target auth-plugin, so this shouldn't break again.
Two things on the deleted files (GitHub won't let me comment inline there):
onboard-join-error-reasons: #389's changeset only covers the translation and Retry on lookup, not the join-failure reasons it restores. Might be worth asking #389 to add that line so it doesn't fall out of the changelog.community-link-after-join: if upstream redeem never returnsorganizationId, then the link code inplugins/auth-ui/src/routes/_public/onboard.tsx(findCommunityPage,onboard.community-link) is dead. Follow-up to remove it, or get upstream to return the id?
A couple of nits inline.
| "@everything-dev/auth-plugin": patch | ||
| --- | ||
|
|
||
| Accepting an organization invitation again requires the signed-in account's own email to match the invited address. A passkey account with a placeholder email can no longer take over an invite link and have the invited address written onto it, marked as verified, without proving it controls that address. Starting onboarding for an event again starts a new station with its own join limit, as before, instead of silently handing back the event's live code. Members of a team with the Events area keep their organizer access: they see Events and Onboarding in My community, keep the Organization link in the sidebar so they can start onboarding from Organization → Onboard, open the community's event pages, see drafts and hidden Luma imports, create and edit events, connect, switch and disconnect the Luma calendar, and approve imports, while the bulletin, social posts, community profile and settings stay with owners and admins. The organization's Homepage tab is back beside Community, so owners and admins can again propose a new homepage to the DAO with their own wallet and follow the vote, and the node page's "Propose homepage change" link opens it. Page, tab and sidebar names stay as they were (Onboarding, Community settings, Organization, Workspace, Directory, Profile) until the product owner settles new ones. |
Collaborator
There was a problem hiding this comment.
nit: the first two sentences (the invite email has to match, and a passkey account can't take over an invite) are auth plugin server behavior, which lives upstream now. The app just calls auth.acceptInvitation. That's the same reason you trimmed the procedure bits from overview-code-redemptions, so maybe drop them here too and keep the UI parts.
| @@ -1,5 +1,4 @@ | |||
| --- | |||
| "@everything-dev/auth-plugin": minor | |||
| "ui": minor | |||
Collaborator
There was a problem hiding this comment.
nit: the last sentence (listOnboardingCodes takes an optional eventId) is about the upstream auth procedure. The UI only passes it along (ui/src/components/discovery/event-onboarding.tsx:89). Could cut it like the procedure sentences you cut from overview-code-redemptions and admin-onboarding-joins.
This was referenced Oct 24, 2026
elliotBraem
added a commit
that referenced
this pull request
Oct 24, 2026
…ing rules - how-it-fits.md: "Read the runtime's own state" — the .bos surfaces table (generated map, resolved-config vs published comparison, logs as last-resort truth, platform manifest, deploy-state, sync-backup, regression caches) plus the clean-at-source rule with TODO(#596) citing the upstream log-retention issue; teach-from-state principle added. - change-placement.md: classify via resolved-config comparison; clean-up-at- source rule; new "Branching and stacking" section (default one-branch-per- ticket; stack only on unmerged-own dependencies, branching from the named base; never branch from the working tree HEAD — cite the #429 absorption; parallel independent work coordinates via conflict comments, #416 model). - docs/agents/testing.md (new): when to test, the three layers, the parent-coverage boundary (compose/hydrate/mounts assumed upstream, npm ships no tests; verify-runtime-map as the cheap claim check; upstream #593 the future home), fitting the regression setup (boot economics, cookie cache, serial-by-design, watchdog), and how to write a good regression test. - tests/README.md + AGENTS.md: pointers to the doctrine; everything-dev-app skill: stack-on-named-base line in Work the frontier. All doc paths land in sync globs so the promotion ticket carries them upstream.
elliotBraem
added a commit
that referenced
this pull request
Oct 24, 2026
…ing rules - how-it-fits.md: "Read the runtime's own state" — the .bos surfaces table (generated map, resolved-config vs published comparison, logs as last-resort truth, platform manifest, deploy-state, sync-backup, regression caches) plus the clean-at-source rule with TODO(#596) citing the upstream log-retention issue; teach-from-state principle added. - change-placement.md: classify via resolved-config comparison; clean-up-at- source rule; new "Branching and stacking" section (default one-branch-per- ticket; stack only on unmerged-own dependencies, branching from the named base; never branch from the working tree HEAD — cite the #429 absorption; parallel independent work coordinates via conflict comments, #416 model). - docs/agents/testing.md (new): when to test, the three layers, the parent-coverage boundary (compose/hydrate/mounts assumed upstream, npm ships no tests; verify-runtime-map as the cheap claim check; upstream #593 the future home), fitting the regression setup (boot economics, cookie cache, serial-by-design, watchdog), and how to write a good regression test. - tests/README.md + AGENTS.md: pointers to the doctrine; everything-dev-app skill: stack-on-named-base line in Work the frontier. All doc paths land in sync globs so the promotion ticket carries them upstream.
elliotBraem
added a commit
that referenced
this pull request
Oct 24, 2026
…olicy (#431) * docs(agents): change-placement flow + how-it-fits explainer; standards goals - docs/agents/change-placement.md: one branch per need — bug, missing capability, pattern improvement, improving the flow itself. First rule encodes the session's learning: sync-owned files are a contribution channel, not a fence — edit there AND file upstream in the same PR. - docs/agents/how-it-fits.md: human-facing drawn tour of the runtime (authored → published → resolved → served; mounts/core-wins; generated types; where source lives; framework-internals pointers). /teach builds lessons from it. - CODING_STANDARDS.md: write-once / type-safety-as-drift-killer / workaround goals added as review-time rules with concrete citations; comments policy — none in implementation, `KEEP:` earns one, `TODO(<ticket>)` points at tracked work; deletions-first for comments and tests. No script: review enforces it from the diff. - AGENTS.md + README: pointers to the flow, the explainer, the standards. * docs(agents): ground teachings in .bos state; testing doctrine; stacking rules - how-it-fits.md: "Read the runtime's own state" — the .bos surfaces table (generated map, resolved-config vs published comparison, logs as last-resort truth, platform manifest, deploy-state, sync-backup, regression caches) plus the clean-at-source rule with TODO(#596) citing the upstream log-retention issue; teach-from-state principle added. - change-placement.md: classify via resolved-config comparison; clean-up-at- source rule; new "Branching and stacking" section (default one-branch-per- ticket; stack only on unmerged-own dependencies, branching from the named base; never branch from the working tree HEAD — cite the #429 absorption; parallel independent work coordinates via conflict comments, #416 model). - docs/agents/testing.md (new): when to test, the three layers, the parent-coverage boundary (compose/hydrate/mounts assumed upstream, npm ships no tests; verify-runtime-map as the cheap claim check; upstream #593 the future home), fitting the regression setup (boot economics, cookie cache, serial-by-design, watchdog), and how to write a good regression test. - tests/README.md + AGENTS.md: pointers to the doctrine; everything-dev-app skill: stack-on-named-base line in Work the frontier. All doc paths land in sync globs so the promotion ticket carries them upstream.
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release has failed since #390 because 16 changesets still target
@everything-dev/auth-plugin, which is no longer in the workspace. If Release isn't wanted anymore, close this instead.add-member-caller-authorization: lives upstream.email-proof-of-control: Add email returns 404.onboard-join-error-reasons: lost in chore: consumer break-off — extend the published base, drop the vendored fork #357; restored in fix(auth): translate event onboarding and retry failed invite lookups #389 (open).onboard-joined-after-code-closes: not on main.community-link-after-join: upstream's redeem doesn't returnorganizationId, so the link never shows.auth-ui(3):auth-ui-error-handling,owner-facing-names,remove-build-and-staking-prototype.auth-pluginline (8): the rest.auth-ui-error-handling,admin-onboarding-joinsandoverview-code-redemptions.changeset statusandchangeset versionnow pass.