jekyll-theme-zer0 1.22.0 → 1.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9bb7f0d10a0dcb7cbe5297c6a412db670fc837d5acc43c85b6752baab5acf5a9
-  data.tar.gz: '0095e82963f7316a63fecdf355f6fb3e8a126c7528666ab540d274175dda515c'
+  metadata.gz: f65c3a0d1bdabc361ffa201b1ef8718b51d9d90ac9f562d465cbcf11da23cff3
+  data.tar.gz: 5a688bea4feaf4b0408a072cf0d23dea6922aaab810dfea9e71f5e6d55147b29
 SHA512:
-  metadata.gz: 0240ae6516cbc159ae33925ad991e74b958ddbbe19c3806fdf6cde01ba7e625ae6a530184cde8a3e51d5e7748944eba105fec439cde7332910bce2e027f2b5d7
-  data.tar.gz: 80283b4cb1950832efac7b7713f660bab1d106adcc0dbeb320c385570a95cc5fd8e6f88614fd09fabdbc44081369300bc6e4e88ade905125edf5caad4ac14c74
+  metadata.gz: 021abbb9996ad7419ce2d27e73ece0234e79f63b8fca7f9ce1619406f91d5e61eabe9ab352257dc09df144c45a75ffa79aa9ff4120c354384fdf3c65420d2557
+  data.tar.gz: 01f76088c04901271942a073140c1ab38ac98bb1ed9ec2defa4d20cb532e331589415f341fa62a0dc34e20ad4a6194a6d9e34477e35d601a8e3593e96d830f22

data/CHANGELOG.md

@@ -5,6 +5,61 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.24.0](https://github.com/bamr87/zer0-mistakes/compare/v1.23.0...v1.24.0) (2026-07-01)
+
+
+### Features
+
+* **features:** backfill PR/commit/issue provenance + render it ([#264](https://github.com/bamr87/zer0-mistakes/issues/264)) ([03b584a](https://github.com/bamr87/zer0-mistakes/commit/03b584aab91332fd0e91f48210a7455da5bc6d08))
+* **features:** document 16 reconciled features (ZER0-061..076) + governance ([#267](https://github.com/bamr87/zer0-mistakes/issues/267)) ([097e842](https://github.com/bamr87/zer0-mistakes/commit/097e842426d62189d527719d07ac609a970a3084))
+
+
+### Bug Fixes
+
+* **features:** reconcile registry with the real repo + add validation gate ([#262](https://github.com/bamr87/zer0-mistakes/issues/262)) ([786459c](https://github.com/bamr87/zer0-mistakes/commit/786459cc611bcc829cd81c971dc6cd1a4f3ba82d))
+* **security:** close two DOM-XSS sinks (CodeQL js/xss-through-dom) ([#266](https://github.com/bamr87/zer0-mistakes/issues/266)) ([812f247](https://github.com/bamr87/zer0-mistakes/commit/812f2478e0cc1989f599e32ac2171a0da449567f))
+
+## [1.23.0](https://github.com/bamr87/zer0-mistakes/compare/v1.22.0...v1.23.0) (2026-06-30)
+
+
+### Features
+
+* **automation:** issue-triage→PR autopilot (off by default) ([#243](https://github.com/bamr87/zer0-mistakes/issues/243)) ([229e076](https://github.com/bamr87/zer0-mistakes/commit/229e07654915a9a0e401b30796c4f6c078eda926))
+* **automation:** verify-and-close lane — autopilot closes human issues fixed on main when CI is green ([#247](https://github.com/bamr87/zer0-mistakes/issues/247)) ([7cc7cb0](https://github.com/bamr87/zer0-mistakes/commit/7cc7cb0cdada7f64d59f46c2f4c3a7e88afbde6b))
+* **layouts:** add color_mode_default config knob with FOUC prevention ([#253](https://github.com/bamr87/zer0-mistakes/issues/253)) ([55bee97](https://github.com/bamr87/zer0-mistakes/commit/55bee970686c10a08aeed15bff43c3b66b5293e7))
+
+
+### Bug Fixes
+
+* **ci:** make claude-run truly OAuth-first — drop API key whenever an OAuth token is set ([#248](https://github.com/bamr87/zer0-mistakes/issues/248)) ([d2b44d2](https://github.com/bamr87/zer0-mistakes/commit/d2b44d2766f5c8543f4c5d8ddb79015e726f88fd))
+* **ci:** pass -R to gh pr view in the self-repair opt-in gate ([#260](https://github.com/bamr87/zer0-mistakes/issues/260)) ([67d67d7](https://github.com/bamr87/zer0-mistakes/commit/67d67d74146366afe6d495f529ba2c86a4513e18))
+* **includes:** existence-guard component-showcase demo links ([#219](https://github.com/bamr87/zer0-mistakes/issues/219)) ([#256](https://github.com/bamr87/zer0-mistakes/issues/256)) ([ef15e79](https://github.com/bamr87/zer0-mistakes/commit/ef15e79dc64db0dc7e721ca10bb7c1e826612473))
+* **layouts:** existence-gate /authors/ breadcrumb in author.html for remote-theme consumers ([#252](https://github.com/bamr87/zer0-mistakes/issues/252)) ([cae21a7](https://github.com/bamr87/zer0-mistakes/commit/cae21a7107b1875ac876f9e30cf71590ac7b0cc5))
+* **search:** existence-gate search modal form action for remote-theme consumers ([#257](https://github.com/bamr87/zer0-mistakes/issues/257)) ([b915c4d](https://github.com/bamr87/zer0-mistakes/commit/b915c4dead5eff3d6a2986720ebacdcf2bed5e33))
+* **skins:** map dark + contrast skins to their background assets ([#245](https://github.com/bamr87/zer0-mistakes/issues/245)) ([fb8808e](https://github.com/bamr87/zer0-mistakes/commit/fb8808e5ec754785b8239b01bccfab99569b70fa)), closes [#240](https://github.com/bamr87/zer0-mistakes/issues/240)
+
+## [Unreleased]
+
+### Bug Fixes
+
+* **includes:** existence-guard component-showcase demo links — breadcrumb and list-group items now render as real links when the target page exists in the build (`/docs/`, `/docs/customization/`, `/categories/`, `/tags/`) and as plain text when absent; removes inert `href="#"` / `onclick="return false;"` workaround ([#219](https://github.com/bamr87/zer0-mistakes/issues/219)) (evidence: [`test/visual/evidence/component-showcase/`](test/visual/evidence/component-showcase/README.md))
+
+### Tests
+
+* **navigation:** regression spec for section-sidebar /tags/ existence gate — asserts "Browse All Tags" and "View All Tags" links only render when /tags/ page is present in the build (issue #218, `test/visual/section-sidebar-tags-gate.spec.js`)
+### Features
+
+- **color_mode_default config knob** — new `color_mode_default` setting (`dark` | `light` | `auto`, default `auto`) in `_config.yml` controls Bootstrap's `data-bs-theme` both server-side (in `_layouts/root.html`) and client-side. An early inline script (`_includes/core/color-mode-init.html`, loaded before Bootstrap CSS) applies the correct theme before any `[data-bs-theme]` selector is evaluated, preventing FOUC. `localStorage["theme"]` (the Appearance panel override) always wins over the config default. `auto` follows `prefers-color-scheme` — backward-compatible with the previous behaviour. (evidence: [`test/visual/evidence/color-mode-default/`](test/visual/evidence/color-mode-default/README.md))
+- **feature provenance** — every entry in the feature registry (`_data/features.yml`) gained a `provenance:` block (`introduced_in` / `pr` / `commit` / `issue`) tracing the feature to the change that shipped it, surfaced on `/features/` as a `PR #N · <commit>` line on each card and a new **Provenance** column in the reference table. A registry-validation gate (`scripts/validate-features.rb`, the `features` test suite) now requires provenance on every active feature. (evidence: [`test/visual/evidence/features-provenance/`](test/visual/evidence/features-provenance/README.md))
+- **feature registry coverage** — reconciled the registry against the codebase: added 16 previously-undocumented features (ZER0-061…076 — author profiles, news/section/article layouts, theme-skins customizer, nanobar, setup wizard, table-CSV copy, share actions, archives, component showcase, and the AI-content-review / giscus-digest / evidence-gate / autonomous-pipeline / secret-scan workflows), each with provenance + a regression-test link. Every active feature now also declares a `tests:` block (`scripts/validate-features.rb` hard-enforces both provenance and tests), and the governance in [`features.instructions.md`](.github/instructions/features.instructions.md) requires them on every new entry.
+### Bug Fixes
+
+* **search:** existence-gate search modal form action to `/sitemap/` only when that page is present in the build; falls back to `#` (safe no-op) for remote-theme Pages consumers without a `/sitemap/` stub (closes [#202](https://github.com/bamr87/zer0-mistakes/issues/202))
+* **layouts:** existence-gate `/authors/` breadcrumb link in author.html for remote-theme consumers ([#204](https://github.com/bamr87/zer0-mistakes/issues/204))
+### Tests
+
+* **tests:** add negative-path smoke tests for AI chat render guard — asserts FAB/panel are absent when `proxy_ready: false` and no `api_key` is set (closes #168)
+
 ## [1.22.0](https://github.com/bamr87/zer0-mistakes/compare/v1.21.0...v1.22.0) (2026-06-26)
 
 

data/_data/ai.yml

@@ -0,0 +1,10 @@
+# =============================================================================
+# _data/ai.yml — one place the AI model is configured for zer0-mistakes agents
+# -----------------------------------------------------------------------------
+# Read by .github/actions/claude-run (the issue-autopilot's AI step). Change the
+# model here and every autopilot agent call uses it. Auth is NOT here — it comes
+# from the CLAUDE_CODE_OAUTH_TOKEN (preferred) or ANTHROPIC_API_KEY secret.
+# =============================================================================
+provider: anthropic
+model: claude-opus-4-8
+max_tokens: 8000

data/_data/backlog.yml

@@ -62,8 +62,8 @@
 
 meta:
   title: "zer0-mistakes Backlog"
-  updated: 2026-06-26
-  next_id: 32
+  updated: 2026-06-29
+  next_id: 33
 
 tasks:
   # --- Housekeeping (seeded so the loop has work on day one) ------------------
@@ -270,7 +270,7 @@ tasks:
 
   - id: T-010
     title: "Complete v1.9 quickstart docs rewrite with getting-started guide and screenshots"
-    status: open
+    status: done
     priority: P2
     area: docs
     risk: low
@@ -286,9 +286,9 @@ tasks:
       - "At least one guide beyond `bare-minimum.md` covers the standard fork/remote-theme workflow."
       - "Each guide includes at least one screenshot stored under `assets/images/docs/quickstart/`."
       - "All new pages pass `docs-validate.yml` front-matter and link checks."
-    links: { issue: null, pr: null, roadmap: "1.9" }
+    links: { issue: 126, pr: null, roadmap: "1.9" }
     created: 2026-06-01
-    updated: 2026-06-01
+    updated: 2026-06-29
 
   - id: T-011
     title: "Add Ruby unit tests for uncovered _plugins/ generators"
@@ -358,7 +358,7 @@ tasks:
 
   - id: T-013
     title: "Refresh Playwright snapshot baselines and re-arm the pixel gate"
-    status: open
+    status: done
     priority: P2
     area: tests
     risk: standard
@@ -373,9 +373,9 @@ tasks:
       - "Baselines under `test/visual/snapshots/` regenerated and committed."
       - "`continue-on-error: true` removed from the snapshot step in `ci.yml`."
       - "Snapshot tier passes in CI on an unchanged follow-up commit."
-    links: { issue: null, pr: null, roadmap: "1.13" }
+    links: { issue: 135, pr: null, roadmap: "1.13" }
     created: 2026-06-10
-    updated: 2026-06-10
+    updated: 2026-06-29
 
   - id: T-014
     title: "Re-arm the docs link-check gate (remove warn-only || true)"
@@ -538,7 +538,7 @@ tasks:
 
   - id: T-020
     title: "CI coverage for installer interactive wizard and upgrade path (coverage rank #2)"
-    status: open
+    status: done
     priority: P2
     area: tests
     risk: standard
@@ -554,13 +554,13 @@ tasks:
       - "Wizard prompt helpers exercised non-interactively (piped answers) in a test_install_* suite."
       - "An upgrade fixture covers detect→migrate→verify for at least one version gap."
       - "Suites run in CI via the standard installer e2e discovery (test_install_*.sh)."
-    links: { issue: null, pr: null, roadmap: "1.14" }
+    links: { issue: 147, pr: null, roadmap: "1.14" }
     created: 2026-06-12
-    updated: 2026-06-12
+    updated: 2026-06-29
 
   - id: T-021
     title: "Vendor cytoscape.js so the Obsidian graph works without a CDN"
-    status: open
+    status: done
     priority: P3
     area: feat
     risk: standard
@@ -577,9 +577,9 @@ tasks:
       - "cytoscape.min.js committed under assets/vendor/ and referenced via a local path."
       - "full-graph.html no longer references cdn.jsdelivr.net."
       - "The graph page renders nodes/edges with the vendored file (no network)."
-    links: { issue: null, pr: null, roadmap: null }
+    links: { issue: 152, pr: null, roadmap: null }
     created: 2026-06-13
-    updated: 2026-06-13
+    updated: 2026-06-29
 
   # --- 2026-06-15 audit -------------------------------------------------------
 
@@ -637,7 +637,7 @@ tasks:
 
   - id: T-024
     title: "Unit tests for scripts/content-review.rb scoring engine"
-    status: open
+    status: done
     priority: P2
     area: tests
     risk: standard
@@ -657,13 +657,13 @@ tasks:
       - "At least one test verifies the `--strict` flag exits non-zero when the fail threshold is crossed."
       - "Tests run under `LC_ALL=C` (locale-independence parity with T-015 guard)."
       - "`./scripts/bin/test` stays green with the new tests included."
-    links: { issue: null, pr: null, roadmap: null }
+    links: { issue: 166, pr: null, roadmap: null }
     created: 2026-06-15
-    updated: 2026-06-15
+    updated: 2026-06-29
 
   - id: T-025
     title: "Playwright smoke tests for the site-wide search modal"
-    status: open
+    status: done
     priority: P2
     area: tests
     risk: standard
@@ -683,13 +683,13 @@ tasks:
       - "A result-population check: query matching a known post title (e.g. 'Hello World') yields at least one result `<a>` element."
       - "Mutual-exclusion guard: opening search while Settings offcanvas is open closes the offcanvas first (no stacked backdrops)."
       - "Spec runs in the smoke project (`npx playwright test --project=smoke`) without a network request to an external index."
-    links: { issue: null, pr: null, roadmap: null }
+    links: { issue: 167, pr: 208, roadmap: null }
     created: 2026-06-15
-    updated: 2026-06-15
+    updated: 2026-06-29
 
   - id: T-026
     title: "Playwright smoke test for AI chat widget render guard and FAB visibility"
-    status: open
+    status: done
     priority: P3
     area: tests
     risk: standard
@@ -710,9 +710,9 @@ tasks:
       - "A mock-config test (inject `data-ai-chat-enabled` attribute or use a fixture page with the widget force-enabled) verifies the FAB renders and the chat panel toggles open/closed on click."
       - "The test passes in the smoke project without a live AI backend."
       - "`./scripts/bin/test` (including the Playwright smoke tier) stays green."
-    links: { issue: null, pr: null, roadmap: null }
+    links: { issue: 168, pr: 250, roadmap: null }
     created: 2026-06-15
-    updated: 2026-06-15
+    updated: 2026-06-29
 
   # --- Issue intake 2026-06-26: remote-theme 404 cluster + docs ----------------
   # Cap: 5 of 7 open issues triaged this run. Deferred (next run): #203 (consumer
@@ -721,7 +721,7 @@ tasks:
 
   - id: T-027
     title: "Theme chrome injects unconditional links (/authors/, /news/, /tags/, /posts/, graph) that 404 for remote-theme consumers"
-    status: open
+    status: done
     priority: P2
     area: a11y
     risk: standard
@@ -740,13 +740,13 @@ tasks:
       - "Theme-injected chrome links render only when their target exists (mirror the footer Quick-Links existence guard)."
       - "A link check over a built remote-theme `_site` reports no theme-injected 404s."
       - "No edit to `lib/jekyll-theme-zer0/version.rb` or release files."
-    links: { issue: 204, pr: null, roadmap: null }
+    links: { issue: 204, pr: 252, roadmap: null }
     created: 2026-06-26
-    updated: 2026-06-26
+    updated: 2026-06-29
 
   - id: T-028
     title: "remote_theme Pages consumers 404 on /search.json and /sitemap/ (generator is plugin-only)"
-    status: open
+    status: done
     priority: P2
     area: feat
     risk: standard
@@ -764,13 +764,13 @@ tasks:
       - "On a remote-theme Pages build, the navbar search resolves (no /search.json 404) or degrades gracefully."
       - "The /sitemap/ link resolves (no 404) for a remote-theme consumer."
       - "No new runtime dependency; no edit to version/release files."
-    links: { issue: 202, pr: null, roadmap: null }
+    links: { issue: 202, pr: 257, roadmap: null }
     created: 2026-06-26
-    updated: 2026-06-26
+    updated: 2026-06-29
 
   - id: T-029
     title: "Guard the unconditional /tags/ link in section-sidebar.html for remote-theme consumers"
-    status: open
+    status: done
     priority: P2
     area: feat
     risk: low
@@ -786,13 +786,13 @@ tasks:
       - "The sidebar 'View All Tags' link renders only when the tags index exists (or a documented site flag is set)."
       - "Remote-theme consumers no longer 404 from the sidebar link; the Jekyll build stays green."
       - "A `test/visual/*.spec.js` regression asserts the conditional render (theme-ui / visual-evidence)."
-    links: { issue: 218, pr: null, roadmap: null }
+    links: { issue: 218, pr: 254, roadmap: null }
     created: 2026-06-26
-    updated: 2026-06-26
+    updated: 2026-06-29
 
   - id: T-030
     title: "component-showcase.html hardcodes demo links (/docs/, /pages/, /docs/customization/) that 404 for consumers"
-    status: open
+    status: done
     priority: P3
     area: feat
     risk: low
@@ -809,13 +809,13 @@ tasks:
       - "The showcase's demo links are parameterized or existence-guarded (no hardcoded absolute paths that can 404)."
       - "Including the showcase on a consumer site produces no theme-injected 404s; the Jekyll build stays green."
       - "A `test/visual/*.spec.js` regression covers the parameterized/guarded links (theme-ui / visual-evidence)."
-    links: { issue: 219, pr: null, roadmap: null }
+    links: { issue: 219, pr: 256, roadmap: null }
     created: 2026-06-26
-    updated: 2026-06-26
+    updated: 2026-06-29
 
   - id: T-031
     title: "Document the safe-mode build-overlay recipe for consumers building outside GitHub Pages"
-    status: open
+    status: done
     priority: P3
     area: docs
     risk: low
@@ -832,6 +832,34 @@ tasks:
       - "A docs page/section under `pages/_docs/` documents the build-overlay recipe (clone -> overlay -> strip _plugins -> strict build)."
       - "It is cross-linked from the remote-theme/deploy docs and passes markdownlint + the content-review deterministic tier."
       - "No code change; docs only."
-    links: { issue: 220, pr: null, roadmap: null }
+    links: { issue: 220, pr: 251, roadmap: null }
     created: 2026-06-26
     updated: 2026-06-26
+
+  - id: T-032
+    title: "Add color_mode_default config knob (dark|light|auto) with FOUC prevention"
+    status: done
+    priority: P2
+    area: feat
+    risk: low
+    effort: S
+    source: issue
+    route: theme-ui
+    summary: >-
+      Implement a color_mode_default config key (values dark|light|auto, default auto).
+      Server-side: root.html reads site.color_mode_default and sets data-bs-theme
+      accordingly (auto resolves to dark as SSR fallback). Client-side: an early inline
+      script (_includes/core/color-mode-init.html, before Bootstrap CSS) applies the
+      correct theme respecting both the config default and a localStorage["theme"] override,
+      preventing FOUC. auto follows prefers-color-scheme — backward-compatible.
+    acceptance:
+      - "site.color_mode_default: dark|light|auto is documented in _config.yml."
+      - "root.html server-renders data-bs-theme from the config (not hardcoded 'dark')."
+      - "An early inline script before Bootstrap CSS prevents FOUC for all three modes."
+      - "localStorage['theme'] override wins over the config default."
+      - "auto follows prefers-color-scheme; backward-compatible with the previous behaviour."
+      - "Regression spec test/visual/color-mode-default.spec.js passes (smoke tier)."
+      - "Before/after evidence committed under test/visual/evidence/color-mode-default/."
+    links: { issue: 241, pr: 253, roadmap: null }
+    created: 2026-06-29
+    updated: 2026-06-29