3 Commits

Include renames

Author	SHA1	Message	Date
shad	973aa9c15b	fix(security): lock CSP script-src to self (no unsafe-inline/unsafe-eval) ... Oracle round-9 hard blocker: live CSP advertised script-src 'self' 'unsafe-inline' 'unsafe-eval'. Verified the Vite build emits zero inline <script> tags (only external module script) and no bundled dep uses new Function / eval (reactflow / leaflet / zustand / dagre / cmdk / framer-motion all clean). - nginx.conf script-src reduced to 'self'. - img-src extended for OSM tiles (https://*.tile.openstreetmap.org) and leaflet marker images served from unpkg. Also (Oracle round-9 second blocker) chat_sidebar QA now creates a thread + sends a message before asserting, then strict-asserts threadRowCount >= 1 AND previewRows === threadRowCount AND timeBadges === threadRowCount. No more vacuous PASS when sidebar is empty.	2026-06-14 15:42:28 +04:00
shad	4bc7ae228a	feat: rebuild Process Studio into multi-phase Process Creation Wizard\n\n- Replace toy Studio.tsx with proper Wizard.tsx canvas\n- Build 6-step flow: Intake -> Analyze -> Generate -> Validate -> Draft saved -> Publish\n- Implement incremental EA2 writes via wizardApi.ts (flow, batch apply)\n- Use localStorage for draft recovery across reloads\n- Apply industrial-blueprint UI styling matching core doctrine\n- Add Vitest tests for Wizard components and API wrappers	2026-06-14 03:47:26 +04:00
shad	2b83e3ad0e	deploy: Dockerfile + nginx + Gitea Actions build ... Two-stage build (node:22 → nginx:1.27) bakes dist/ into a static image. nginx reverse-proxies /api/* to demo.flow-master.ai so live mode works same-origin without CORS. CI runs vitest + build, then publishes gitea.flow-master.ai/shad/mission-control-demo:sha-${git} on push to main. Constraint: backend rejects cross-origin → same-origin proxy required Confidence: high Scope-risk: narrow Not-tested: image actually built in Gitea Actions (requires registry secret)	2026-06-14 00:10:56 +04:00